alright - first I see is that "/var/www/vhosts/domain.org/cgi-bin/.cgi_wrapper" got the wrong user/group ...
And what user/group does this file have? --> "/var/www/vhosts/domain.org/cgi-bin/.cgi_wrapper/.phpwrapper" <-- guess it's root:root too as the main directory?
I did a chown yesterday
-r-x------ 1 domainuser psaserv 161 Jan 14 20:26 /var/www/vhosts/domain.org/cgi-bin/.cgi_wrapper/.phpwrapper
[root@vps-1121582-14368 ~]# ll -a /var/www/vhosts/domain.org
total 80
drwxr-xr-x 20 root root 4096 Jan 14 20:19 .
drwxr-xr-x 19 root root 4096 Jan 14 20:19 ..
drwxr-x--- 5 domainuser psaserv 4096 Jan 14 20:19 anon_ftp
drwxr-xr-x 2 root root 4096 Jan 14 20:19 bin
drwxr-x--- 4 domainuser psaserv 4096 Jan 14 20:24 cgi-bin
drwxr-x--- 2 root psaserv 4096 Jan 14 21:02 conf
drwxr-xr-x 2 root root 4096 Jan 14 20:19 dev
drwxr-xr-x 2 root psaserv 4096 Jan 14 20:19 error_docs
drwxr-xr-x 2 root root 4096 Jan 14 20:19 etc
drwxr-x--- 7 domainuser psaserv 4096 Jan 14 20:37 httpdocs
drwxr-xr-x 2 root root 4096 Jan 14 20:19 lib
drwxr-xr-x 2 root root 4096 Jan 14 20:19 lib64
drwxr-x--- 2 root psaserv 4096 Jan 14 21:02 pd
drwx------ 2 domainuser root 4096 Jan 14 20:19 private
dr-xr-x--- 7 domainuser psaserv 4096 Jan 14 20:19 statistics
drwxr-xr-x 2 root psaserv 4096 Jan 14 20:19 subdomains
drwxrwxrwt 2 root root 4096 Jan 14 20:19 tmp
drwxr-xr-x 4 root root 4096 Jan 14 20:19 usr
drwxr-xr-x 3 root root 4096 Jan 14 20:19 var
drwxr-xr-x 2 root psaserv 4096 Jan 14 20:19 web_users