ConfigServer Community Forum

I am getting a lot of "exploits" undetected by CXS on normal settings.
I have my sever set to bayes low for report & quarantine and am getting these quarantined. I am protected so aren't worried for me, but in the course of my work I am seeing a lot of newly exploited wordpress sites and no one has yet proved what exploit is allowing the sites to be used for distributing malware
I know they are evil, can they be added to fingerprints please, or will that detect too many innocent files that are similar

uses wp-admin/admin-ajax.php

Yes this is the problem.

Especially the files in the base64 content can not be detected.

I always use the same settings, although there is no difference, the ability to detect after the new versions of the cxs has been greatly reduced.