Rapid7 released Metasploit 6.5 on Friday with thirteen new modules, and four of them target flaws that CISA already lists as under active attack. The headline addition is a working exploit for the WordPress core bug chain that has sat on the federal exploited-vulnerabilities catalog since 21 July, packaged so that anyone who can run a command line can use it.
That is the part defenders should read twice. A vulnerability being exploited by a handful of skilled crews is a serious problem for the organizations they pick. The same vulnerability with a stable, documented Metasploit module is a problem for everyone still unpatched, because the skill needed to use it drops to almost nothing.
Two WordPress bugs, chained into one shell
The module Rapid7 calls WP2Shell chains a REST API batch endpoint route confusion flaw (CVE-2026-63030, CVSS 7.5) with an SQL injection in the author__not_in parameter of WP_Query (CVE-2026-60137, CVSS 5.9). Neither is rated critical on its own. Together, according to the wrap-up, they let an unauthenticated attacker elevate privileges, deploy a payload as a custom plugin and open a remote session on the server. WordPress core 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1 are affected, and the fixes are 6.9.5 and 7.0.2, with 6.8.6 covering the SQL injection on the older branch. IntelFusions reported the chain under active exploitation in July, when the first public proof of concept surfaced. The module credits Adam Kues, Crypto-Cat, TF1T, dtro and haongo.
The SonicWall bug tied to ransomware
Next is CVE-2026-15409 (CVSS 10), a server-side request forgery in the SonicWall SMA1000 WorkPlace wsproxy service. Server-side request forgery means the appliance can be talked into making requests on an attacker's behalf, reaching internal systems it should not touch. CISA added it to the exploited list on 14 July and flags it as known to be used in ransomware campaigns. IntelFusions covered that warning at the time. The module is credited to Deral Heiland, Ryan Emmons and Rapid7 Vulnerability Research.
A kernel bug and an AI server round out the set
Fragnesia (CVE-2026-46300), from William Bowling and msutovsky-r7, is a local privilege escalation against what Rapid7 describes as a page-cache replacement flaw in the Linux kernel's XFRM (IPsec) subsystem. No CVSS score is published for it in the National Vulnerability Database, and the wrap-up describes no exploitation path, so the kernel advisory carries the detail. A fourth module targets CVE-2026-33017 (CVSS 9.3) in Langflow, the AI workflow builder, hitting an endpoint that needs no authentication in versions before 1.9.0. IntelFusions wrote about CISA's Langflow warning this month. A fifth covers the Joomla Content Editor flaw CVE-2026-48907 (CVSS 10), on the exploited list since June.
Meterpreter can now change its shape
The framework changes matter as much as the modules. Metasploit 6.5 adds a MALLEABLEC2 option to Meterpreter HTTP and HTTPS payloads, letting an operator load a profile that changes the shape of the implant's web traffic. Rapid7 says every Meterpreter has it: Windows, Java, Python, PHP and Linux. Detection content keyed to the default look of Meterpreter web traffic gets less reliable as a result. The release also adds Windows on ARM (AArch64) reverse TCP command shells, putting Snapdragon-based Windows machines in scope, plus eight new Model Context Protocol tools wrapping the framework's RPC endpoints. JSON RPC now requires authentication by default.
Patch the four that are already being used
Move WordPress to 6.9.5 or 7.0.2, apply SonicWall's SMA1000 fix, update Langflow to 1.9.0 or later and Joomla Content Editor past 2.9.99.4. All four sit on CISA's exploited list, so federal agencies are already under a remediation deadline for them. For the kernel issue, follow your distribution's advisory. Then go looking: an exploit this clean leaves web shells behind, so check WordPress installs for plugins nobody remembers adding, and appliances for outbound requests they have no business making. Rapid7 publishes the full changelog in its release wrap-up, written by Diego Ledda.
Metasploit has always rested on an argument that public exploit code helps defenders more than it helps attackers, because most of the people it arms are testing their own networks. That argument holds while patching keeps pace with the modules. Four of this week's thirteen point at things attackers reached first.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.