Directadmin account hacked - sent server spam - HELP

[accorn]

One of my directadmin admin accounts was hacked into and was used to send thousands of spam emails.
Directadmin sent me a warning that 12000 emails had been sent.
I changed the password on the account, deleted all the files on the website in question (It was a wordpress site so I was wondering if wordpress was hacked), and cleared all the spam that was in the mail queue.. and so far it looks like the spamming has now stopped.

But i'm not sure how the account was compromised. I'm the only "user" on the server - and the account in question is not actively logged into - and I use cryptic passwords.
The only thing I can think of is possibly the wordpress install was hacked and used to send the emails via php?

I ran rkhunter to make sure no rootkits have been installed and it was clean.
Is there anything else I should be doing to make sure the server itfself wasn't hacked?

The server in question is running centos 6.5, with suphp.

Thanks for any advice!

 

[accorn]

Another thing

I should mention the wordpress install was version 4.0.. not that old.
But it did have some plugins that were not fully up to date.

 

[ditto]

WordPress 4.0 has a critical vulnerability that was fixed in WordPress 4.0.1 released November 20: https://wordpress.org/news/2014/11/wordpress-4-0-1/ However it should have been automatically upgraded to WordPress 4.0.1, but sometimes it does not work. So if you was running WordPress 4.0, it could be WordPress that was compromised. Of course, if there was security fixes in some of your plugins that was not updated, that is also likely to be how WordPress was compromised.

 

[SeLLeRoNe]

To check how it was compromised, you should check first if email was sent using SMTP Auth or from a PHP script.

Probably your WP installation was insecure and not updated to 4.0.1 or even worst, a plugin you've installed need updated since is insecure, if so, maybe neither the WP update would solve your issue.

For sure i would suggest to set a very lower limit (let's say somethibg between 100 and 250) unless you need a very high one.. 12000 looks pretty too much.

Also, since you say'd you're using CentOS 6.5, you should run yum update (CentOS 6.6 is out there) and check if you have some updated also with:

cd /usr/local/directadmin/custombuild && ./build update && ./build versions

With this you can check avaible updates, and in case installed them (most of them using ./build program_name)

Regards