R3Zk0N

Pegasus CMS 1.0 contains a remote code execution vulnerability in the extra fields.php plugin that allows unauthenticated attackers to execute arbitrary commands by exploiting unsafe eval functionality. Attackers can send POST requests to the submit.php endpoint with malicious PHP code in the action parameter to achieve code execution and obtain an interactive shell.

**Name of the Vulnerable Software and Affected Versions** JetEngine WordPress plugin versions prior to 3.1.3.1 **Description** The issue allows for remote code execution due to the plugin's failure to properly verify that uploaded files are not executable. **Recommendations** For versions prior to 3.1.3.1, update to version 3.1.3.1 or later to resolve the issue.