The vulnerability allows an unauthenticated attacker to upload files of any type because the function ced_rnx_order_exchange_attach_files does not validate the file’s MIME type or extension. This flaw is classified as CWE-434. An attacker could place a PHP, .htaccess, or other executable file on the server and then execute it via the web server, giving full remote code execution on the WordPress site. The impact is a complete compromise of confidentiality, integrity, and availability for the affected website.

The flaw exists in the WP Swings WooCommerce Refund And Exchange with RMA – Warranty Management, Refund Policy, Manage User Wallet add‑on for WordPress. Versions 3.2.6 and earlier are vulnerable. Sites using any of those versions hosted on a standard WordPress installation are at risk.

The CVSS score of 9.8 indicates a critical vulnerability. The EPSS score of <1% reflects a low probability of exploitation in the current field. The flaw is not listed in the CISA KEV catalog, but the lack of authentication combined with the ability to upload arbitrary files makes it theoretically straightforward for an attacker to discover the upload endpoint and place malicious content. The attack is delivered over the network through an unauthenticated HTTP request, and the attacker could proceed to execute the uploaded file if the server treats it as executable.