PluginCheck.CodeAnalysis.WriteFile.ABSPATHDetected
ABSPATHDetected
The plugin writes files in or near plugin-controlled directories.
Why It Shows Up
Plugin Check found file creation or modification behavior that may affect the plugin directory or executable files.
Why It Matters
Runtime writes to plugin code directories can break updates, create permission issues, or introduce supply-chain risk.
How to Fix
- Store generated data in uploads, cache, or another WordPress-approved writable location.
- Validate paths and file names against strict allowlists.
- Avoid modifying plugin source files at runtime.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1 | BulletProof Security | 0 | 5,048 | 4,949 | 20k+ | Output is not escaped | ||
| #2 | Themify Builder | 9 | 5,304 | 2,136 | 5k+ | Text Domain Mismatch | ||
| #3 | AnyComment | 17 | 445 | 449 | 5k+ | Output is not escaped | ||
| #4 | wpForo Forum | 17 | 4,048 | 2,922 | 20k+ | Unsafe printing function | ||
| #5 | Pix por Piggly (para Woocommerce) | 20 | 547 | 195 | 4k+ | Exception output is not escaped | ||
| #6 | Premium Packages – Sell Digital Products Securely | 20 | 2,021 | 2,190 | 2k+ | Non-prefixed global variable | ||
| #7 | Backup Migration | 21 | 981 | 1,093 | 80k+ | Non-prefixed global variable | ||
| #8 | Kadence Security – Password, Two Factor Authentication, and Brute Force Protection | 21 | 1,060 | 957 | 700k+ | Missing Translators Comment | ||
| #9 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots | 21 | 1,621 | 2,033 | 10k+ | Direct Query | ||
| #10 | DELUCKS SEO | 21 | 362 | 1,171 | 400 | Missing nonce verification | ||
| #11 | Buckaroo Woocommerce Payments Plugin | 21 | 638 | 321 | 2k+ | Exception output is not escaped | ||
| #12 | Wordfence Security – Firewall, Malware Scan, and Login Security | 21 | 1,592 | 2,973 | 5m+ | Output is not escaped | ||
| #13 | WP phpMyAdmin | 21 | 4,528 | 6,435 | 50k+ | Missing Arg Domain | ||
| #14 | WebTotem Security | 21 | 1,110 | 213 | 800 | Text Domain Mismatch | ||
| #15 | ANAC XML Bandi di Gara | 22 | 294 | 244 | 500 | Output is not escaped | ||
| #16 | Backup Bolt | 22 | 580 | 1,313 | 800 | Non-prefixed global variable | ||
| #17 | Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer | 22 | 2,854 | 1,269 | 50k+ | Text Domain Mismatch | ||
| #18 | Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization | 22 | 1,306 | 2,818 | 8k+ | Output is not escaped | ||
| #19 | NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall | 22 | 1,263 | 2,046 | 100k+ | Non-prefixed global variable | ||
| #20 | PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP | 22 | 984 | 407 | 5k+ | Unsafe printing function | ||
| #21 | RapidLoad AI – Optimize Web Vitals Automatically | 22 | 81 | 840 | 700 | Nonce verification recommended | ||
| #22 | Admin and Site Enhancements (ASE) | 23 | 139 | 328 | 200k+ | Nonce verification recommended | ||
| #23 | Beds24 Online Booking | 23 | 532 | 374 | 2k+ | wp function not compatible with requires wp | ||
| #24 | BuddyPress | 23 | 584 | 9,012 | 90k+ | Non-prefixed function | ||
| #25 | InfiniteWP Client | 23 | 2,287 | 1,811 | 200k+ | Exception output is not escaped | ||
| #26 | MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO | 23 | 485 | 580 | 2k+ | Missing nonce verification | ||
| #27 | Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | 23 | 2,129 | 993 | 300k+ | Text Domain Mismatch | ||
| #28 | Photo Gallery by 10Web – Mobile-Friendly Image Gallery | 23 | 4,159 | 1,553 | 100k+ | Output is not escaped | ||
| #29 | Security Plugin, Firewall & Malware Scanner with Auto Removal | 23 | 1,204 | 789 | 40k+ | Output is not escaped | ||
| #30 | Slider by 10Web – Responsive Image Slider | 23 | 5,814 | 976 | 10k+ | Output is not escaped | ||
| #31 | The Pack Elementor addon | 23 | 556 | 1,180 | 2k+ | Non-prefixed global variable | ||
| #32 | Germanized for WooCommerce | 23 | 224 | 1,296 | 70k+ | Non-prefixed function | ||
| #33 | WP STAGING – WordPress Backups, Restore, Migration & Clone | 23 | 1,525 | 1,610 | 100k+ | Non-prefixed global variable | ||
| #34 | A2 Optimized WP – Turbocharge and secure your WordPress site | 24 | 271 | 231 | 60k+ | Missing Arg Domain | ||
| #35 | All-In-One Security (AIOS) – Security and Firewall | 24 | 552 | 1,228 | 1m+ | Non-prefixed global variable | ||
| #36 | Backuply – Backup, Restore, Migrate and Clone | 24 | 711 | 556 | 600k+ | Non-prefixed global variable | ||
| #37 | Builderall for WordPress | 24 | 4,778 | 1,307 | 1k+ | Text Domain Mismatch | ||
| #38 | Spam protection, Honeypot, Anti-Spam by CleanTalk | 24 | 817 | 1,125 | 200k+ | Missing nonce verification | ||
| #39 | Defender Security – Malware Scanner, Login Security & Firewall | 24 | 550 | 593 | 80k+ | Non-prefixed namespace | ||
| #40 | Easy Optimizer – PageSpeed, Cache & Core Web Vitals (Unused CSS, Delay JS, Lazy Load) | 24 | 194 | 514 | 500 | Direct Query | ||
| #41 | F12 Profiler | 24 | 282 | 451 | 500 | Direct Query | ||
| #42 | InstaWP Connect – 1-click WP Staging & Migration | 24 | 254 | 815 | 40k+ | Non-prefixed global variable | ||
| #43 | SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress | 24 | 246 | 300 | 1k+ | Direct Query | ||
| #44 | Service Box Slider | 24 | 618 | 1,410 | 500 | Non-prefixed global variable | ||
| #45 | SiteGuard WP Plugin | 24 | 359 | 350 | 500k+ | Output is not escaped | ||
| #46 | Slideshow Gallery LITE | 24 | 896 | 414 | 5k+ | Output is not escaped | ||
| #47 | GEO Plugin by Squirrly SEO | 24 | 1,202 | 230 | 30k+ | Missing Translators Comment | ||
| #48 | Tutor LMS – eLearning and online course solution | 24 | 332 | 4,432 | 100k+ | Non-prefixed global variable | ||
| #49 | Vimeography: Vimeo Video Gallery WordPress Plugin | 24 | 98 | 212 | 5k+ | Nonce verification recommended | ||
| #50 | WP Fastest Cache – WordPress Cache Plugin | 24 | 541 | 753 | 1m+ | Unsafe printing function |
