Excessive CPU usage userswp plugin

Hello.

I had noticed the WP admin section of our site was very, very slow (frequent 504 errors) yesterday and asked SiteGround for help.

Though their support is normally excellent, the first support agent reported, “Uh, looks okay to me…”

I re-opened that ticket today and the next level support person hit on the issue nearly immediately providing this:

Hello Duane,

I have checked your account and indeed there is excessive CPU usage in the last three days, caused by the admin-ajax.php script:

Code:
[email protected] [~]# executions bestauto 2 | grep ajax
10133 /home/bestauto/public_html/wp-admin/admin-ajax.php – the number, shoes how many times the script was executed two days ago
[email protected] [~]# executions bestauto 1 | grep ajax
297358 /home/bestauto/public_html/wp-admin/admin-ajax.php – yesterday
[email protected] [~]# executions bestauto | grep ajax
71097 /home/bestauto/public_html/wp-admin/admin-ajax.php – today

The issue started two days ago and yesterday it was over the top, leading to almost 300 000 script executions by the script, which leads us to the message you received:

https://s.nimbusweb.me/share/3492451/kmx30t41nrdkw15gbvqc

I have scanned your account for malware, in order to check if this leads to the issue, but there is none. After that I have checked your installation logs and noticed that the admin-ajax execution are connected to the URL:

Code:
[email protected] [~/access-logs]# grep ‘wp-admin/admin-ajax.php?action=wp_1_uwp_updater’ bestretirementcommunitiesusa.com-ssl_log | wc -l
42113

After some research, I found that the calls are made by the plugin:

https://wordpress.org/plugins/userswp/

Unfortunately, the CPU usage got so high (eating up 90% of our monthly CPU allotment in just a few days) their monitoring team shut off the account temporarily until the issue is fixed.

I went in via FTP and renamed “userswp” to “userswp-old”.

I also requested the site be turned back on so we can do further homework on it to see if that reduced the huge lags I was seeing.

And, of course, since I am only technologically “advanced” enough to be “dangerous”, I will need help from you folks to figure out why a plugin which had been installed many months ago somehow went “crazy” (or if something else interacting with that plugin did.)

Speaking of which, one thing I did notice is that there was a message at the top of the plugins screen which appeared recently indicating Yoast SEO had turned off “user profiles”.

Let me know what you need from SiteGround or me, etc. and I will gladly comply.

Thank you,

Duane