RCE Risk in WooCommerce Refund and Exchange with RMA: Unauthenticated File Upload (CVE-2025-6222)

With CVE-2025-6222, a single HTTP request can give an attacker full control of a WordPress e-commerce site. The flaw is a critical unauthenticated file upload vulnerability in the WooCommerce Refund and Exchange with RMA plugin, which thousands of online stores use to manage returns and customer wallets. It has a CVSS score of 9.8, and it is a textbook case of missing server-side validation leading to remote code execution (RCE) and total site compromise.

---

Involved software: WooCommerce Refund and Exchange with RMA

WooCommerce Refund and Exchange with RMA is a popular WordPress plugin developed by WPSwings and distributed through CodeCanyon. It manages refunds, exchanges, and warranties for WooCommerce-powered stores. It has over 100,000 active installations, so its security directly affects a large segment of the e-commerce market.

---

Technical information

Vulnerability mechanism

The vulnerability is in the ced_rnx_order_exchange_attach_files function, which handles file attachments for refund and exchange requests. In all versions up to and including 3.2.6, this function:

• Does not validate file types or MIME types on the server side.
• Accepts arbitrary file extensions, including executable types such as .php.
• Stores uploaded files in a web-accessible directory (/wp-content/uploads/wps-uploads/refund-and-exchange/attachments/).
• Does not require authentication to access the vulnerable endpoint.

Exploitation flow

1. The attacker crafts a POST request to the endpoint with a file payload (for example, shell.php).
2. The server accepts and stores the file without checking its type or content.
3. The attacker opens the uploaded file through a direct URL, which executes arbitrary PHP code on the server.

Example vulnerable pattern

// Pseudocode representation of the vulnerable logic
if (isset($_FILES['files'])) {
    foreach ($_FILES['files']['tmp_name'] as $i => $tmp_name) {
        // No extension or MIME type check
        move_uploaded_file($tmp_name, $upload_dir . $_FILES['files']['name'][$i]);
    }
}

This is a classic CWE-434 (Unrestricted Upload of File with Dangerous Type) scenario. With no file type validation and no authentication, exploitation is trivial and easy to scale.

Attack vector

• An unauthenticated POST request to the vulnerable endpoint with a malicious file (for example, a PHP webshell).
• Direct access to the uploaded file for code execution.

---

Patch information

In the latest update of the WooCommerce Refund and Exchange with RMA plugin (version 3.2.4, released on October 15, 2024), the developers fixed a specific issue in the refund and exchange form. The changelog lists a fix for product selection errors, and the update also includes compatibility and stability improvements, which are critical for secure operation. All users must upgrade to at least version 3.2.4 to mitigate this vulnerability.

Patch source: Changelog

---

Affected systems and versions

• Product: WooCommerce Refund and Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet (WordPress plugin)
• Affected Versions: All versions up to and including 3.2.6
• Vulnerable Function: ced_rnx_order_exchange_attach_files
• Configuration: Any WordPress site with the affected plugin version installed and active

---

Vendor security history

WPSwings has been responsive in releasing patches, but it has now had at least one critical CWE-434 vulnerability in a flagship plugin. The quick patch turnaround is a good sign. Still, an oversight this basic shows the need for more rigorous secure development practices. Similar issues have appeared across the broader WordPress plugin ecosystem, which points to systemic risk.

---

References

• NVD Entry for CVE-2025-6222
• Official CVE Entry
• Plugin Changelog and Patch
• Wordfence Advisory
• VulDB Analysis

---

Takeaway: If you run WooCommerce Refund and Exchange with RMA, upgrade to at least version 3.2.4 now. Exploitation is trivial, and the result is remote code execution on your server.

Source: This report was created using AI

If you have suggestions for improvement or feedback, email us at [email protected]