Yes, the most common cause of a WordPress site getting hacked or having malware injections is failing to update your WordPress Core version.