Hosting a Content Management System (like Wordpress, Joomla, Drupal, and moslty all other CMS) means permitting users* to upload arbitrary files.
(* As users I mean: your authorized - but not necessarily experienced - users. Thanks to Jan Doggen for this precision)
So even if
your server doesn't try to execute this files,
your server is up to date and doesn't hold any known vulnerabilities
Uploaded files could be downloaded by other users and website visitors, who could use vulnerable systems.
In order to prevent this, if you hold arbitrary shared files, you have to check new uploaded files... And recheck them everytime your virus database will be upgraded (thanks to Steffen Ullrich for warning me about this)
- are the only authorized user on the box (or you really trust each other users)
- don't care about what's happen outside your box,
- keep your box up to date finely
Wordpress work fine without anti-virus