CVE-2019-25687
Pegasus CMS 1.0 contains a critical remote code execution flaw in the extra_fields.php plugin. An unauthenticated attacker can send a crafted POST request to submit.php with malicious PHP code in the action parameter, allowing them to run arbitrary commands and obtain a shell.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Pegasus CMS 1.0 (CPE: wisdom pegasus_cms 1.0). The vulnerability affects any website running this version of the CMS.
Real-world impact
An attacker who exploits this flaw can execute any PHP code on the server, effectively taking full control of the website, stealing data, installing malware, or using the server for further attacks.
Why this severity
The CVSS score of 9.3 reflects the vulnerability’s high impact (confidentiality, integrity, and availability are all fully compromised) combined with its remote, unauthenticated nature and lack of mitigations. The score indicates a critical risk that requires immediate attention.
What to do about it
- ›Disable the extra_fields.php plugin or restrict access to the submit.php endpoint so that only trusted users can reach it.
- ›Consider upgrading to a newer version of Pegasus CMS if one is available, or apply any vendor‑issued patches once released.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Apr 5, 2026 · Apr 5, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- exploit-db.com/exploits/46542exploitvdb entry
- vulncheck.com/advisories/pegasus-cms-remo…third party advisory
- wisdom.com.au/web/pegasus-cmsproduct