WordPress is out of date
sec_cms_outdatedShort answer
Your WordPress core is behind the current release. Update it from Dashboard › Updates (or with wp core update) and keep automatic minor updates on, so security releases install within hours of publication.
Why it matters
WordPress security releases describe what they fix, and automated bots start probing sites that still run the old version soon after. A compromised WordPress site typically gets hidden spam pages, injected links or redirects, and Google may label it "This site may be hacked" in results or take a manual action for hacked content, which is a direct search impact. Only the latest major version is officially supported.
How Glimana detects it
This check runs only when your pages load files from /wp-content/ or /wp-includes/; otherwise it is Not applicable. Glimana reads the version from the generator meta tag, otherwise from the generator line of /feed/, otherwise from the most common ?ver= value on /wp-includes/ files that matches a real WordPress release. It compares that version with the WordPress.org release list (api.wordpress.org, refreshed daily): a version marked insecure is high, one marked outdated is medium, the latest passes. If no version can be found, the result is Could not be measured.
How to fix it
Watch out
Take a full backup (files and database) before a major update, check that your PHP version meets the new release's requirement, and test on a staging copy if the site relies on many plugins. Hiding the version number does not fix anything; it only turns the result into Could not be measured.
- Find the finding in Glimana. Open Security; this check is in the Outdated software group, with the evidence from the last scan under its title. The same problem is listed under Issues › WordPress is out of date.
-
Apply the fix on your platform.
Go to Dashboard › Updates and click Update to version x.y.z. On the same screen you can choose automatic updates for all new versions. Minor (security) updates are automatic by default; if they are not happening, look in
wp-config.phpforAUTOMATIC_UPDATER_DISABLEDorWP_AUTO_UPDATE_COREset tofalseand remove it.Many managed WordPress hosts control core updates themselves and may pin a version. Check the host's panel for an update or version setting, or ask support to update the site and keep security releases automatic.
Run
wp core version, thenwp core updateandwp core update-db. To allow automatic minor updates, adddefine( 'WP_AUTO_UPDATE_CORE', 'minor' );towp-config.php. - Check it in Glimana. Press Re-scan on the Security page (up to two scans an hour) or wait for the weekly scan on Sunday; the problem closes when the check passes.
How the fix is verified
After the fix, press Re-scan on the Security page (or wait for the weekly Sunday 04:00 scan); the problem closes when the check passes.