Pegasus CMS 1.0 is vulnerable to remote code execution through the extra_fields.php plugin, which improperly evaluates user-supplied PHP code. An unauthenticated attacker can craft POST requests targeting the submit.php endpoint, inserting malicious PHP code into the action parameter. Successful exploitation grants the attacker the ability to execute arbitrary commands on the webserver, potentially providing full control and an interactive shell. This flaw exposes the system to complete confidentiality, integrity, and availability compromise.

The vulnerability applies to Pegasus CMS version 1.0, distributed by wisdom. No other versions or products are listed as affected.

The CVSS score of 9.3 indicates critical severity, and the lack of available EPSS information means the exploit probability is uncertain but high risk remains due to the lack of authentication requirement. The CISA KEV database does not list this issue, suggesting it is not yet widely exploited, yet the strongly unfettered vector means attackers can reach the target via standard HTTP requests. If the CMS is exposed to the internet, attackers can trivially trigger the vulnerability by sending crafted requests, leading to immediate compromise without additional prerequisites.