How do you find exploits without risking someone seeing your attempt and reporting you as a hacker? do you register first somewhere?

You can run Wordpress locally in your own sandbox to test these vulnerabilities, you don’t have to break any laws.