The vulnerability CVE-2025-6222 affects the WP Swings WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet plugin for WordPress. The issue arises from the lack of file type validation in the 'ced_rnx_order_exchange_attach_files' function, allowing unauthenticated attackers to upload arbitrary files. This can lead to remote code execution on the server hosting the affected plugin. The vulnerability is present in all versions up to and including 3.2.6. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix has been documented in the provided data.

Successful exploitation allows unauthenticated attackers to upload arbitrary files to the affected WordPress site, potentially leading to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.8, the impact is severe and could result in full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict file upload permissions, disable the vulnerable functionality if possible, and monitor for suspicious file uploads. Avoid exposing the affected plugin on publicly accessible sites without additional protective controls.