Update WordPress to the current release
Why it matters
WordPress.org itself lists the WordPress version this site shows as insecure, so it misses security fixes that are already published. Updating closes those holes; the newest release of your line is the smallest step, the current release the best one.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Check the version in the dashboard (Dashboard, Updates) or with wp core version. If it is newer than the one in the finding, a cache or CDN is serving an old generator tag; clear it and rescan.
- Take a full backup of the files and the database, and try the update on a staging copy first if the site has custom code or old plugins.
- Update WordPress core to the current release named in the finding. If a big jump is not possible right away, update at least to the newest release of your own line (also named in the finding), which has the security fixes for it.
- Update all plugins and themes afterwards, remove the ones you do not use, and turn automatic background updates for minor releases back on (they are on by default; a site this far behind usually has them switched off).
Related
Scan your domain to see whether this applies to you.