In reply to mark k..

I'm agree with you: 4.1 but witch minor version?
4.1.10 (that receive automatic update from 4.1) it's full patched and secure even if it's not the latest 4.4.2.
Running "wpscan" on the website in not enought to understand the real cause of the leak.