Metasploit Wrap Up: Lot of summer shells and fit http profiles

Rapid7's Metasploit Framework 6.5 release adds 13 new modules, including exploits for WordPress WP2Shell, Ghost CMS, Joomla JCE, Langflow, OpenCATS, Pterodactyl Panel, SonicWall SMA1000, Ray Dashboard, Pix-for-WooCommerce, and the Fragnesia Linux kernel LPE (CVE-2026-46300). The update also introduces HTTP malleable profiles, MCP functionality, Linux multi fetch payloads, and AArch64 reverse-TCP shells for Windows on ARM. Notable vulnerabilities addressed include CVE-2025-49132 in Pterodactyl Panel before 1.11.11 and CVE-2026-15409 in SonicWall SMA1000 WorkPlace wsproxy.

This wrap-up brings a full-on shell parade. Thirteen shiny new modules landed, starting with a buffet of RCEs. WordPress WP2Shell, Ghost CMS, Joomla JCE, Langflow, OpenCATS, Pterodactyl Panel, SonicWall SMA1000, Ray Dashboard, a Pix-for-WooCommerce, and for those who like their exploits closer to the bare-metal, the Fragnesia Linux kernel LPE CVE-2026-46300 . Metasploit also got the glow-up of the summer with the new http malleable profiles, MCP functionality and linux multi fetch payloads more details on the official 6.5 release blog post https://www.rapid7.com/blog/post/pt-metasploit-framework-6-5-released/ . Windows on ARM confirm to be the new first-class citizenship thanks to brand-new AArch64 reverse-TCP shells both inline and staged , so your Snapdragon boxes can join the party too. Last but not least, an important message: Nyan Nyan Nyan Nyan Nyan Nyan. Author: Richard Howe <rhowe425 Type: Auxiliary Pull request: 21681 https://github.com/rapid7/metasploit-framework/pull/21681 contributed by rmhowe425 https://github.com/rmhowe425 Path: gather/ray dashboard logs api path traversal Description: This adds an auxiliary module that leverages a path traversal vulnerability in Ray to list the contents of local directories. There is currently no CVE assigned to this vulnerability. Issuance is pending with MITRE. Authors: 0xtensho and jheysel-r7 Type: Exploit Pull request: 21452 https://github.com/rapid7/metasploit-framework/pull/21452 contributed by jheysel-r7 https://github.com/jheysel-r7 Path: linux/http/pterodactyl locales locale json AttackerKB reference: CVE-2025-49132 https://attackerkb.com/search?q=CVE-2025-49132&referrer=blog Description: This adds a module which exploits a vulnerability in Pterodactyl Panel before version 1.11.11 that allows unauthenticated remote code execution through improper handling of locale file operations. The vulnerability, CVE-2025-49132, exists in the locale.json endpoint which allows path traversal and arbitrary file creation. This combination of capabilities results in remote code execution in the context of the user running the web server. Authors: Deral Heiland, Rapid7 Vulnerability Research, and Ryan Emmons Type: Exploit Pull request: 21678 https://github.com/rapid7/metasploit-framework/pull/21678 contributed by dheiland-r7 https://github.com/dheiland-r7 Path: linux/http/sonicwall sma1000 wsproxy rce AttackerKB reference: CVE-2026-15409 https://attackerkb.com/search?q=CVE-2026-15409&referrer=blog Description: This adds a new exploit module for CVE-2026-15409, a Server-Side Request Forgery SSRF vulnerability in the SonicWall SMA1000 WorkPlace wsproxy service. Authors: William Bowling and msutovsky-r7 Type: Exploit Pull request: 21456 https://www.google.com/search?q=https://github.com/rapid7/metasploit-framework/pull/21456 contributed by msutovsky-r7 https://github.com/msutovsky-r7 Path: linux/local/cve 2026 46300 fragnesia AttackerKB reference: CVE-2026-46300 https://www.google.com/search?q=https://attackerkb.com/search%3Fq%3DCVE-2026-46300%26referrer%3Dblog Description: This adds a local module for the Fragnesia exploit which is a page-cache replacement vulnerability in the Linux kernel's XFRM IPsec subsystem, tracked as CVE-2026-46300. Authors: Cristian-Alexandru Staicu and Maksim Rogov Type: Exploit Pull request: 21234 https://www.google.com/search?q=https://github.com/rapid7/metasploit-framework/pull/21234 contributed by vognik https://github.com/vognik Path: multi/http/ghostcms auth rce cve 2026 29053 AttackerKB reference: CVE-2026-22594 https://www.google.com/search?q=https://attackerkb.com/search%3Fq%3DCVE-2026-22594%26referrer%3Dblog Description: This adds an exploit module for Ghost CMS CVE-2026-29053 that achieves remote code execution by uploading a malicious theme. Ghost's theme renderer evaluates untrusted JSONPath expressions through the {{ get}} helper, letting the module inject and trigger arbitrary code once a theme is uploaded and activated. You'll need valid admin or staff credentials to authenticate. Authors: David Jardin, Uwe Flottemesch, and ispyispyispy Type: Exploit Pull request: 21615 https://www.google.com/search?q=https://github.com/rapid7/metasploit-framework/pull/21615 contributed by 15py15py15py https://www.google.com/search?q=https://github.com/15py15py15py Path: multi/http/joomla com jce unauth file upload rce AttackerKB reference: CVE-2026-48907 https://www.google.com/search?q=https://attackerkb.com/search%3Fq%3DCVE-2026-48907%26referrer%3Dblog Description: This adds a new exploit module for CVE-2026-48907, an unauthenticated arbitrary profile creation vulnerability in the JCE Joomla Content Editor extension for Joomla . The profiles.import task fails to enforce authentication, letting an attacker import a crafted profile that is written to disk as a PHP web shell, resulting in remote code execution when the tmp/ directory is directly accessible. All JCE versions up to and including 2.9.99.4 are affected, and no credentials are required. Authors: Diamorphine and Richard Howe Type: Exploit Pull request: 21700 https://www.google.com/search?q=https://github.com/rapid7/metasploit-framework/pull/21700 contributed by rmhowe425 https://github.com/rmhowe425 Path: multi/http/langflow unauth rce cve 2026 33017 AttackerKB reference: CVE-2026-33017 https://www.google.com/search?q=https://attackerkb.com/search%3Fq%3DCVE-2026-33017%26referrer%3Dblog Description: Adds a new multi/http/langflow unauth rce cve 2026 33017 exploit module that exploits an unauth RCE vulnerability in the /api/v1/build public tmp/{flow id}/flow endpoint in Langflow versions prior to 1.9.0. Authors: Chocapikk and stlthr4k3r Type: Exploit Pull request: 21630 https://www.google.com/search?q=https://github.com/rapid7/metasploit-framework/pull/21630 contributed by stlthr4k3r https://github.com/stlthr4k3r Path: multi/http/opencats installer rce AttackerKB reference: CVE-2026-27760 https://www.google.com/search?q=https://attackerkb.com/search%3Fq%3DCVE-2026-27760%26referrer%3Dblog Description: Adds an exploit module targeting CVE-2026-27760, a PHP code injection in OpenCATS. Authors: Adam Kues, Crypto-Cat, TF1T, dtro, and haongo Type: Exploit Pull request: 21686 https://www.google.com/search?q=https://github.com/rapid7/metasploit-framework/pull/21686 contributed by Crypto-Cat https://github.com/Crypto-Cat Path: multi/http/wp batch desync rce AttackerKB reference: CVE-2026-60137 https://www.google.com/search?q=https://attackerkb.com/search%3Fq%3DCVE-2026-60137%26referrer%3Dblog Description: This adds an exploit module to target WP2Shell, an unauthenticated pre-auth remote code execution vulnerability affecting WordPress core versions 6.9.0–6.9.4 and 7.0.0–7.0.1. The module chains a REST API route confusion flaw CVE-2026-63030 with an SQL injection CVE-2026-60137 to elevate privileges, deploy a payload via a custom plugin, and execute a remote session. Authors: Alexis Lafontaine and Maksim Rogov Type: Exploit Pull request: 21683 https://www.google.com/search?q=https://github.com/rapid7/metasploit-framework/pull/21683 contributed by vognik https://github.com/vognik Path: multi/http/wp plugin pix unauth rce cve 2026 3891 AttackerKB reference: CVE-2026-3891 https://www.google.com/search?q=https://attackerkb.com/search%3Fq%3DCVE-2026-3891%26referrer%3Dblog Description: Adds CVE-2026-3891 WordPress Unauthenticated RCE Exploit module targeting Pix for WooCommerce plugin. Authors: OJ Reeves, Spencer McIntyre Type: Payload Single Pull request: 21728 https://www.google.com/search?q=https://github.com/rapid7/metasploit-framework/pull/21728 contributed by zeroSteiner https://github.com/zeroSteiner Description: Adds support for a new MALLEABLEC2 option to Meterpreter HTTP S payloads. This feature enables users to load a standard profile into Meterpreter and change the shape of its HTTP S traffic. All Meterpreters, including Windows, Java, Python, PHP and Linux, have been updated with this functionality. Author: vinicius-batistella Type: Payload Single Pull request: 21589 https://www.google.com/search?q=https://github.com/rapid7/metasploit-framework/pull/21589 contributed by vinicius-batistella https://github.com/vinicius-batistella Path: windows/aarch64/shell reverse tcp Description: Adds Windows on ARM AArch64 reverse-TCP command-shell payload. Author: vinicius-batistella Type: Payload Stager Pull request: 21744 https://www.google.com/search?q=https://github.com/rapid7/metasploit-framework/pull/21744 contributed by vinicius-batistella https://github.com/vinicius-batistella Path: windows/aarch64/shell/reverse tcp Description: Adds Windows AARCH64 staged shell payloads. You can find the latest Metasploit documentation on our docsite at docs.metasploit.com https://docs.metasploit.com/ . As always, you can update to the latest Metasploit Framework with msfupdate and you can get more details on the changes since the last blog post from GitHub: If you are a git user, you can clone the Metasploit Framework repo https://www.google.com/search?q=%5Bhttps%3A%2F%2Fgithub.com%2Frapid7%2Fmetasploit-framework%5D%28https%3A%2F%2Fgithub.com%2Frapid7%2Fmetasploit-framework%29 master branch for the latest. To install fresh without using git, you can use the open-source-only Nightly Installers https://www.google.com/search?q=%5Bhttps%3A%2F%2Fgithub.com%2Frapid7%2Fmetasploit-framework%2Fwiki%2FNightly-Installers%5D%28https%3A%2F%2Fgithub.com%2Frapid7%2Fmetasploit-framework%2Fwiki%2FNightly-Installers%29 or the commercial edition Metasploit Pro https://www.google.com/search?q=%5Bhttps%3A%2F%2Fwww.rapid7.com%2Fproducts%2Fmetasploit%2Fdownload%2F%5D%28https%3A%2F%2Fwww.rapid7.com%2Fproducts%2Fmetasploit%2Fdownload%2F%29 .