Why is this so out of date?

[easaw]

Seems odd to be a whole minor version behind? :/

[ocdtrekkie]

The Sandstorm community member who was most recently maintaining this package isn't active in Sandstorm development anymore, and nobody has shown interest in taking it on.

As a note though, Sandstorm's security model makes apps impervious to the vast majority of security flaws by design: While running an out of date WordPress would be risky on most other platforms, it's pretty safe on Sandstorm.