Is this spyware on my site or a real Java update?

There’s an iframe injection according to the source code:

<iframe src="http://ppv2014.info/Java-Recommended%20Update.htm" style="min-width:100%; min-height:100%; height:100%; width:100%; max-width:100%; max-height:100%; overflow: auto; border:none;" frameborder="no"></iframe>

It seems to be enclosed in a div called “pop”:

<div class="pop" id="pop" style="position: fixed; z-index: 100002; border: 4px solid rgb(0, 0, 0); height: 60%; width: 60%; top: 20%; left: 20%; background-color: rgb(255, 255, 255);">...</div>

My best guess is that you have an extension that has been compromised. Disable extensions one by one until it disappears. Failing that, change the theme to see if it’s an infected theme. And failing that, back up the WordPress database and reinstall it.