PluginCheck.CodeAnalysis.WriteFile.ABSPATHDetected
ABSPATHDetected
The plugin writes files in or near plugin-controlled directories.
Why It Shows Up
Plugin Check found file creation or modification behavior that may affect the plugin directory or executable files.
Why It Matters
Runtime writes to plugin code directories can break updates, create permission issues, or introduce supply-chain risk.
How to Fix
- Store generated data in uploads, cache, or another WordPress-approved writable location.
- Validate paths and file names against strict allowlists.
- Avoid modifying plugin source files at runtime.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #101 | Far Future Expiry Header | 40 | 25 | 36 | 7k+ | Request data is not unslashed | ||
| #102 | Heroic Favicon Generator | 41 | 104 | 7 | 6k+ | Output is not escaped | ||
| #103 | Simple Cache | 41 | 33 | 59 | 1k+ | Input is not sanitized | ||
| #104 | WebP Express Plus | 58 | 19 | 11 | 700 | Unsafe printing function | ||
| #105 | Surge | 60 | 46 | 47 | 4k+ | Non-prefixed global variable | ||
| #106 | Post/Page Import Export – Migrate Content with Custom Fields & Taxonomies | 61 | 12 | 27 | 400 | Input is not sanitized | ||
| #107 | Falcon – WordPress Optimizations & Tweaks | 62 | 47 | 66 | 2k+ | Short PHP open tag found | ||
| #108 | FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses | 63 | 48 | 12 | 8k+ | Exception output is not escaped | ||
| #109 | Easy PHP Settings | 66 | 34 | 48 | 1k+ | Missing Translators Comment | ||
| #110 | Simple HTTPS | 67 | 17 | 13 | 400 | Output is not escaped | ||
| #111 | Web Accessibility by accessiBe | 72 | 1 | 25 | 10k+ | Input is not sanitized | ||
| #112 | Dash Notifier | 73 | 12 | 6 | 20k+ | Heredoc Output Not Escaped | ||
| #113 | Emergency password reset | 73 | 56 | 14 | 800 | wp function not compatible with requires wp | ||
| #114 | Soro – SEO Autopilot & AI Content Writer | 83 | 4 | 10 | 10k+ | Input is not sanitized | ||
| #115 | WP BASIC Auth | 83 | 4 | 13 | 3k+ | Input is not sanitized | ||
| #116 | Comments Import & Export | 85 | 112 | 9 | 2k+ | wp function not compatible with requires wp | ||
| #117 | News Element Elementor Blog Magazine | 85 | 174 | 695 | 400 | Non-prefixed global variable | ||
| #118 | Trusted Shops Easy Integration for WooCommerce | 86 | 5 | 67 | 6k+ | Non-prefixed hook name | ||
| #119 | Transferito: WP Migration | 88 | 16 | 115 | 500 | Non-prefixed global variable | ||
| #120 | LovedByAI – Generative Engine Optimization, AI Search, GEO, AEO | 94 | 16 | 800 | Direct Query | |||
| #121 | No-Indexer | 94 | 5 | 6 | 500 | Non-prefixed function | ||
| #122 | iGen SEO | 95 | 5 | 13 | 600 | Non-prefixed hook name | ||
| #123 | WING Website Migrator | 96 | 4 | 400 | Discouraged PHP function | |||
| #124 | HTTP Auth | 97 | 9 | 3 | 6k+ | wp function not compatible with requires wp | ||
| #125 | Speed Up – Browser Caching | 97 | 12 | 1 | 700 | file system operations fclose | ||
| #126 | Manage XML-RPC | 98 | 3 | 1 | 5k+ | file system operations is writable | ||
| #127 | Quads Ads Manager for Google AdSense | 99 | 8 | 20k+ | Non-prefixed constant | |||
| #128 | SendPulse Free Web Push | 100 | 2 | 500 | ABSPATHDetected | |||
| #129 | SQLite Object Cache | 100 | 2 | 10k+ | ABSPATHDetected |
