Short answer
Ubuntu is an open-source Linux operating system used on servers, desktops and cloud infrastructure. On a website server, it provides the environment in which software such as PHP, a web server and a database runs. Updating Ubuntu is not the same as updating WordPress.
Where it fits in a website
A visitor sees a store. The operator sees several layers: operating system, web server, PHP, database and application. Ubuntu can provide the operating-system layer and packages for some of the others.
You can also run software installed through third-party repositories, containers or manual builds. Those may follow a different update path from Ubuntu’s own packages. “The server updates automatically” needs a follow-up: which parts?
What LTS means
LTS stands for long-term support. Canonical’s Ubuntu Server page describes five years of standard security maintenance for packages in the Main repository, with extended coverage available through subscriptions and add-ons.
Coverage depends on the Ubuntu release, package, repository and subscription. Do not read “LTS” as “every piece of software on this machine is maintained indefinitely.”
Why the version number may look old
A vendor can apply a security backport: move a fix into an older package branch without adopting a newer upstream feature release. That preserves compatibility while addressing a specific vulnerability.
Canonical explains this approach. For a particular incident, check the vendor’s security notice and installed package revision. The operating-system support policy alone does not prove that a particular CVE has been fixed.
If you do not manage servers, you still benefit from knowing who does. Your maintenance agreement should make that boundary explicit.