PluginCheck.CodeAnalysis.WriteFile.ABSPATHDetected
ABSPATHDetected
The plugin writes files in or near plugin-controlled directories.
Why It Shows Up
Plugin Check found file creation or modification behavior that may affect the plugin directory or executable files.
Why It Matters
Runtime writes to plugin code directories can break updates, create permission issues, or introduce supply-chain risk.
How to Fix
- Store generated data in uploads, cache, or another WordPress-approved writable location.
- Validate paths and file names against strict allowlists.
- Avoid modifying plugin source files at runtime.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1 | BulletProof Security | 0 | 5,048 | 4,949 | 20k+ | Output is not escaped | ||
| #2 | Themify Builder | 9 | 5,334 | 2,171 | 5k+ | Text Domain Mismatch | ||
| #3 | AnyComment | 17 | 445 | 449 | 5k+ | Output is not escaped | ||
| #4 | wpForo Forum | 17 | 4,306 | 3,026 | 20k+ | Unsafe printing function | ||
| #5 | Administrator Z | 18 | 2,061 | 799 | 400 | Output is not escaped | ||
| #6 | Pix por Piggly (para Woocommerce) | 20 | 547 | 195 | 4k+ | Exception output is not escaped | ||
| #7 | WP Compress – Instant Performance & Speed Optimization | 20 | 4,292 | 3,691 | 10k+ | Non Singular String Literal Domain | ||
| #8 | Premium Packages – Sell Digital Products Securely | 20 | 2,043 | 2,299 | 2k+ | Non-prefixed global variable | ||
| #9 | Backup Migration | 21 | 999 | 1,081 | 80k+ | Non-prefixed global variable | ||
| #10 | Kadence Security – Password, Two Factor Authentication, and Brute Force Protection | 21 | 1,060 | 959 | 700k+ | Missing Translators Comment | ||
| #11 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots | 21 | 1,652 | 2,058 | 10k+ | Direct Query | ||
| #12 | Spam protection, Honeypot, Anti-Spam by CleanTalk | 21 | 833 | 1,133 | 200k+ | Missing nonce verification | ||
| #13 | DELUCKS SEO | 21 | 362 | 1,171 | 300 | Missing nonce verification | ||
| #14 | Buckaroo Payments for WooCommerce | 21 | 692 | 351 | 2k+ | Exception output is not escaped | ||
| #15 | Wordfence Security – Firewall, Malware Scan, and Login Security | 21 | 1,893 | 3,292 | 5m+ | Output is not escaped | ||
| #16 | WP phpMyAdmin | 21 | 4,528 | 6,435 | 40k+ | Missing Arg Domain | ||
| #17 | ANAC XML Bandi di Gara | 22 | 294 | 244 | 500 | Output is not escaped | ||
| #18 | Backup Bolt | 22 | 580 | 1,313 | 800 | Non-prefixed global variable | ||
| #19 | Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer | 22 | 2,854 | 1,269 | 40k+ | Text Domain Mismatch | ||
| #20 | Search Atlas SEO – OTTO AI SEO Automation for WordPress | 22 | 1,403 | 2,878 | 8k+ | Output is not escaped | ||
| #21 | NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall | 22 | 1,263 | 2,046 | 100k+ | Non-prefixed global variable | ||
| #22 | PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP | 22 | 984 | 407 | 5k+ | Unsafe printing function | ||
| #23 | RapidLoad AI – Optimize Web Vitals Automatically | 22 | 81 | 840 | 700 | Nonce verification recommended | ||
| #24 | Admin and Site Enhancements (ASE) | 23 | 145 | 392 | 200k+ | Nonce verification recommended | ||
| #25 | Beds24 Online Booking | 23 | 532 | 374 | 2k+ | wp function not compatible with requires wp | ||
| #26 | BuddyPress | 23 | 584 | 9,012 | 90k+ | Non-prefixed function | ||
| #27 | InstaWP Connect – 1-click WP Staging & Migration | 23 | 252 | 817 | 40k+ | Non-prefixed global variable | ||
| #28 | InfiniteWP Client | 23 | 2,379 | 1,844 | 200k+ | Exception output is not escaped | ||
| #29 | MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO | 23 | 487 | 604 | 2k+ | Missing nonce verification | ||
| #30 | Photo Gallery by 10Web – Mobile-Friendly Image Gallery | 23 | 4,156 | 1,553 | 100k+ | Output is not escaped | ||
| #31 | Slider by 10Web – Responsive Image Slider | 23 | 5,814 | 976 | 10k+ | Output is not escaped | ||
| #32 | The Pack Elementor addon | 23 | 556 | 1,180 | 2k+ | Non-prefixed global variable | ||
| #33 | Germanized for WooCommerce | 23 | 234 | 1,346 | 70k+ | Non-prefixed function | ||
| #34 | WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups | 23 | 1,580 | 1,786 | 100k+ | Non-prefixed global variable | ||
| #35 | WebTotem Security | 23 | 1,091 | 213 | 800 | Text Domain Mismatch | ||
| #36 | A2 Optimized WP – Turbocharge and secure your WordPress site | 24 | 271 | 231 | 60k+ | Missing Arg Domain | ||
| #37 | All-In-One Security (AIOS) – Security and Firewall | 24 | 552 | 1,228 | 1m+ | Non-prefixed global variable | ||
| #38 | Backuply – Backup, Restore, Migrate and Clone | 24 | 729 | 553 | 600k+ | Non-prefixed global variable | ||
| #39 | Builderall for WordPress | 24 | 4,778 | 1,307 | 1k+ | Text Domain Mismatch | ||
| #40 | Defender Security – Malware Scanner, Login Security & Firewall | 24 | 1,327 | 1,329 | 80k+ | Non-prefixed namespace | ||
| #41 | Easy Optimizer – PageSpeed, Cache & Core Web Vitals (Unused CSS, Delay JS, Lazy Load) | 24 | 223 | 543 | 900 | Direct Query | ||
| #42 | F12 Profiler | 24 | 282 | 451 | 400 | Direct Query | ||
| #43 | Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | 24 | 2,218 | 1,045 | 300k+ | Text Domain Mismatch | ||
| #44 | Security Plugin, Firewall & Malware Scanner with Auto Removal | 24 | 1,081 | 808 | 40k+ | SQL query is not prepared | ||
| #45 | SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress | 24 | 289 | 320 | 1k+ | Direct Query | ||
| #46 | Service Box Slider | 24 | 618 | 1,410 | 400 | Non-prefixed global variable | ||
| #47 | SiteGuard WP Plugin | 24 | 363 | 335 | 600k+ | Output is not escaped | ||
| #48 | Slideshow Gallery LITE | 24 | 896 | 414 | 5k+ | Output is not escaped | ||
| #49 | GEO Plugin by Squirrly SEO | 24 | 1,238 | 1,585 | 30k+ | Non-prefixed global variable | ||
| #50 | Tutor LMS – eLearning and online course solution | 24 | 334 | 4,517 | 100k+ | Non-prefixed global variable |
