The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter.
View the template here CVE-2015-9480.yaml
echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2015/CVE-2015-9480.yaml
References: