Patching is now the smaller half of the job, if you still own a WordPress site.
The Hacker News reports a remote code execution flaw in WordPress Core versions 4.7 through 7.1.3: CVSS 8.1, and no CVE identifier. It drew nearly 63,000 exploitation attempts in 24 hours, starting shortly after the patches came out in October.
At that volume the honest assumption is probably that some attempts reached your site before you updated. So once I've patched, I treat it as an incident review rather than a version bump. Sweep the upload and theme directories for dropped files. Look for admin users nobody created, then re-read anything touching checkout, accounts or payouts.
Taking over inherited, undocumented sites and reviewing payment and account flows is work I do directly, and you get cost and timeline within a day: a focused review runs in days, not months.
If you want a second pair of eyes on a site you inherited: https://polycratia.com/c/35a99ceb