Contact Form Hacked

[funnycamel]

Hello. i'm using Thirtybees 1.1.0-1.1.x

I have found that a hacker can send emails on behalf of the website via the CMS, the email goes to ALL customers. I believe this is through some kind of hack via the contact form. For now, I have just completely disabled the Contact Form.

Any advice on how to address this issue? 

Edited February 2, 2021 by funnycamel
more details

[30knees]

Could you share more information how you discovered this?

[ariom]

I think the better for you is to install and configure ASAP this 2 very usefull module:
Blackhole for Bad Bots from DataKick
and
No Captcha reCAPTCHA Module from ThirtyBees
I had the same problem and implementing this two security layers did the trick for me ...

Edited February 2, 2021 by ariom