PluginScore

PluginCheck.CodeAnalysis.WriteFile.ABSPATHDetected

ABSPATHDetected

The plugin writes files in or near plugin-controlled directories.

medium weight

Why It Shows Up

Plugin Check found file creation or modification behavior that may affect the plugin directory or executable files.

Why It Matters

Runtime writes to plugin code directories can break updates, create permission issues, or introduce supply-chain risk.

How to Fix

  • Store generated data in uploads, cache, or another WordPress-approved writable location.
  • Validate paths and file names against strict allowlists.
  • Avoid modifying plugin source files at runtime.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsUpdatedTop Issue
#1BulletProof Security05,0484,94920k+Output is not escaped
#2Themify Builder95,1952,0965k+Text Domain Mismatch
#3AnyComment174454495k+Output is not escaped
#4wpForo Forum174,0332,92220k+Unsafe printing function
#5Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization191,2952,6799k+Output is not escaped
#6Pix por Piggly (para Woocommerce)205471954k+Exception output is not escaped
#7Backup Migration219811,09380k+Non-prefixed global variable
#8Buckaroo Woocommerce Payments Plugin215633262k+Exception output is not escaped
#9Wordfence Security – Firewall, Malware Scan, and Login Security211,5922,9735m+Output is not escaped
#10WP phpMyAdmin214,5286,43550k+Missing Arg Domain
#11Premium Packages – Sell Digital Products Securely212,7652,4443k+Output is not escaped
#12Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots221,6042,01910k+Direct Query
#13BuddyPress225839,008100k+Non-prefixed function
#14Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8581,27050k+Text Domain Mismatch
#15InfiniteWP Client222,2861,812200k+Exception output is not escaped
#16NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall221,2652,065100k+Non-prefixed global variable
#17PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP229844075k+Unsafe printing function
#18Admin and Site Enhancements (ASE)23136330200k+Nonce verification recommended
#19Beds24 Online Booking235323742k+wp function not compatible with requires wp
#20Kadence Security – Password, Two Factor Authentication, and Brute Force Protection231,053967700k+Missing Translators Comment
#21CleanTalk Anti-Spam. Spam Firewall & Bot protection238261,078200k+Missing nonce verification
#22MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO234885802k+Missing nonce verification
#23Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery232,119986400k+Text Domain Mismatch
#24Photo Gallery by 10Web – Mobile-Friendly Image Gallery234,1591,553100k+Output is not escaped
#25Slider by 10Web – Responsive Image Slider235,81497610k+Output is not escaped
#26The Pack Elementor addon235561,1802k+Non-prefixed global variable
#27Tutor LMS – eLearning and online course solution233953,402100k+Non-prefixed global variable
#28Germanized for WooCommerce232191,05470k+Non-prefixed global variable
#29WP STAGING – WordPress Backup, Restore & Migration231,4141,327100k+Non-prefixed global variable
#30A2 Optimized WP – Turbocharge and secure your WordPress site2427123160k+Missing Arg Domain
#31All-In-One Security (AIOS) – Security and Firewall245521,2281m+Non-prefixed global variable
#32Backuply – Backup, Restore, Migrate and Clone24704551700k+Non-prefixed global variable
#33Defender Security – Malware Scanner, Login Security & Firewall2430651880k+Non-prefixed namespace
#34InstaWP Connect – 1-click WP Staging & Migration2425381140k+Non-prefixed global variable
#35Security Plugin, Firewall & Malware Scanner with Auto Removal241,19277030k+Output is not escaped
#36SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress242363041k+Direct Query
#37Slideshow Gallery LITE248964145k+Output is not escaped
#38Vimeography: Vimeo Video Gallery WordPress Plugin24982125k+Nonce verification recommended
#39Payment Gateway for PayPal on WooCommerce2415356110k+Nonce verification recommended
#40WP Fastest Cache – WordPress Cache Plugin245417531m+Unsafe printing function
#41WP Job Portal – AI-Powered Recruitment System for Company or Job Board website24691,0898k+Missing Version
#42Export All Posts, Products, Orders, Refunds & Users243631,1307k+Direct Query
#43Animated Number Counters254081,9492k+Non-prefixed global variable
#44Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid2524385450k+Non-prefixed global variable
#45Breeze Cache25217790400k+Non-prefixed global variable
#46FlatPM – Ad Manager, AdSense and Custom Code253,01755710k+Text Domain Mismatch
#47Index WP MySQL For Speed2525025550k+Output is not escaped
#48LWS Optimize – All-in-One Speed Booster & Cache Tools2543076420k+Non-prefixed global variable
#49BerqWP – Automatic WordPress Website Speed Optimization251985013k+Non-prefixed global variable
#50Sitemap by click5252861326k+Unsafe printing function