To get an honest test, please ensure that you run the firstboot security updates. Then, other than the version of WordPress itself being a little out of date (easily fixed within the WP WebUI), everything should be pretty secure.

Hopefully you don't find anything of concern, but if you do, please let me know ASAP. If it's security related, probably best to shoot us an email to support@turnkeylinux.org (rather than publicly post it - at least until we've had a chance to fix it). FWIW, that email is closely monitored so we won't miss it.