You can run Wordpress locally in your own sandbox to test these vulnerabilities, you don’t have to break any laws.