EMAILS getting flagged as spam. Spammers subscribing via CRM and SMTP.

Ryk Melck so i run a webpage for a client. www.theundergroundlou.com. We have a subscribe form built via Fluent CRM and Fluent forms, Fluent SMTP. , and connected to SMTP to our server. There is only 6 entries on this form. the form has recaptcha V2 on it. however, when i go to the F-SMTP settings i see there are 7k emails sent. I am the only one that has access and have not sent an email out other than test. also did find this form on the bottom of the page from the template. the second pic is a copy of one of the emails.. I have a lot of rejects in my inbox, especially yahoo, gmail, etc.... I deleted the random form, but how do i fix this now?

William Dickson if you are using fluent-forms then I would set up a double optin as mentioned by @wordpress. This would be a good start.

William Dickson you are using an elementor form on the site. This is probably your biggest culprit.

William Dickson the subscribe button, top right of the site is only for logged in users. So maybe you are confusing the two.

Ryk Melck yeah, i deleted the "subscribe" form at the bottom of the footer. I will do the double opt in...

William Dickson The email sent does not match a subscribers email. The screenshot on the right says “Login Details”, while the form says “Subscribe to Newsletter”. It seems you have a different problem than just abusing the newsletter form. Check your log files for any suspicious activity and files. Also check the other emails sent for content. Are all the recipients subscribed (or at least added by your subscription form)? If not, you most likely have someone exploiting any of your plugins. Check for malware.

Mat ‎ that is some good info. let my gaurd down and now I got a bunch of emails about grants, CIALIS and VIAGRA.

William Dickson 

Do you keep your SMTP credentials in wp-config file or directly in fSMTP plugin? I dont think its matter in this case since you see all logs in fSMTP so they use your WP instance for spamming.

Make sure you change your credentials (WP and SMTP).

Did you disable XML-RPC? I dont think so..

Maybe you have malicious (Malware) code added to your WP (snippets, functions.php, index.php, config.php, .htaccess, wp-config.php) and that is how emails being sent via your SMTP plugin? Scan your WP with some "security" plugin.

Check for Malware:

• Scan your site: Install and run a security plugin like Wordfence or Sucuri to scan for malware. 
• Check for suspicious files: Look for new or modified PHP files in the wp-content/uploads directory and other suspicious locations. 
• Examine email headers: Check email headers for unauthorized senders or other suspicious details. 

Mat ‎ personally I would never use elementor as form on a site. That's what I see when I inspect the form on the site mentioned above.

William Dickson there are couple of actions you need to do in addition to wordpress scanning.

Action to do:

• disable xml-rpc (if you are not using it aka it is not needed but you didnt block it yet) - I am pretty sure you dont need it (its a old functionality but used by bad actors).

  How to do it? Snippet:

Add_filter( 'xmlrpc_enabled', '__return_false' );

• disable folder listing - it looks like it is not blocked - you can do it via .htaccess file:

Options -Indexes

/wp-content/uploads/

Dir Listing Enabled

You can upgrade your WP too (make a backup first as always)

WordPress Version
6.2.2
Version does not appear to be latest (6.8.2)

William Dickson btw: it is also recommended to update your plugins to avoid XSS and CSFR - see att.

btw2: you should also add a code to your .htaccess to use always https connection as you might mix links with http etc - just be careful with the code below since you might use www url as a default one (google it if needed)

RewriteEngine on
RewriteCond %{HTTP_HOST} !^example.com$ [OR]
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://example.com%{REQUEST_URI} [R=301,END]

Mat ‎ do i just add this to the bottom of the file?

William Dickson if you are asking about adding that listing or rewrite code to .htaccess then add it somewhere on the top of your file but it will also work when you add it to the bottom of that file (just make a copy of that file before).

https://letslearnwordpress.com/wordpress/disable-directory-listing

For xml-rpc you can use a code snippet:

https://m.youtube.com/watch?v=EAacd5BMFV8

If you dont have a Code Snippet plugin for adding a code snippet then use Fluent Snippets plugin for Free - here is how to use the Fluent Snippets plugin

William Dickson just keep it mind that when you change your server, your IP (xx.xx.xx.255) will change and you need to warm it up before sending large campagns. Therefore in many cases using external ESP for SMTP can be a better solution so when you are migrating your web server, your trusted email sender IP remains "the same".

Good luck!