Comment by kamranjon

You can run Wordpress locally in your own sandbox to test these vulnerabilities, you don’t have to break any laws.