Hi,

Ah, WordPress. So many times I've seen compromised sites and servers that began with an incorrectly-configured, inadequately-secured or out-of-date WordPress install. Seeing 'php-cgi' by itself isn't necessarily sinister. WordPress is PHP based, and so any page you access will certainly spawn a PHP process somehow.

If your server is running Plesk (and from the 'sw-engine-fpm' process in one of your earlier process lists I'm pretty sure it must be), then this is a fairly standard way for Plesk to deal with PHP requests. Any request for a page that needs PHP to handle it will result in a 'php-cgi' process being spawned by Plesk, if it's configured to handle PHP in its usual way.

But I'd definitely start with that WordPress install, in terms of a suspect. At a bare minimum ensure it's up-to-date, that all its plugins are up-to-date (and that they are all legitimate and not malicious or suspicious plugins), that all your WordPress users and admins are ones you actually expect to exist , that they all have good strong passwords set, and so on and so forth. Pay very close attention to anything that allows file uploads in particular. Having anything that allows uploads of any sort without a username and password being required is a disaster waiting to happen, pretty much.