WooCommerce Refund and Exchange with RMA WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the WooCommerce Refund and Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet plugin for WordPress. This issue arises from inadequate file type validation in the 'ced_rnx_order_exchange_attach_files' function, affecting all versions through 3.2.6. The vulnerability allows unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, which may be used to execute malicious code on the server.

Remediation

Users are advised to update the WooCommerce Refund and Exchange with RMA plugin to version 3.2.7 or a newer patched version.