WordPress is popular free and open$-$source content management system. An e$-$commerce website uses WordPress for their website. But the e$-$commerce IT team had installed a plugin.

Later in that year, a vulnerability was discovered in that plugin by security researchers. This vulnerability allows uploading any files to the web server hosting the WordPress instance. A patch was made available to fix this vulnerability by the plugin vendor, but this was not applied to the e$-$commerce website by the IT team.

Hackers discovered the presence of this vulnerable plugin on the website and exploited it to upload malware to the server.

Which of the following options is TRUE with respect to this scenario?

Shredding must be done to dispose the vulnerability

SAST and manual code review could have detected the presence of the vulnerable component.

The e$-$commerce IT team must establish and execute a disposal$/$transition plan to prevent a repeat of these issues.

The IT must maintain an inventory of all their software including dependencies and ensure security updates are done on timely basis.