All software is vulnerable
How often do you need to update WordPress core, themes, and plugins?
All the time! The longer you wait to update, the harder it will be. Some updates build on previous updates. Changes might be made to templates and how data is stored in the database that are more easily managed in increments. Also, more importantly, updates can be critical for security. So waiting even a few days for to perform a critical security update can put your site at risk. When a security vulnerability is discovered, the details of the exploitable code are published on the Internet. Hackers can immediately write bots to automatically crawl the web and exploit these vulnerabilities.