malware from spammers entering into this theme

Hi.

I had a domain with your directory theme installed on a wordpress version around 4.2.

The site was idle there for a couple years. Meanwhile there were several user registrations subscribers along the months, but I was completely ignoring them until now.

These days I noticed strange files in the ftp folder from this theme, with a cron job made to send emails, and several emails to be sent under exim. It looks like these registered users were beeing used for some spam activity. I went today to the admin users list and there where almost 900 users there, none of them made by me. There might be an exploit somewhere !

Does anyone knows where the hackers are entering into the theme to be able to create files and run cron jobs and stuff ?