PluginCheck.CodeAnalysis.WriteFile.PluginDirectoryWrite
Plugin Directory Write
The plugin writes files in or near plugin-controlled directories.
Why It Shows Up
Plugin Check found file creation or modification behavior that may affect the plugin directory or executable files.
Why It Matters
Runtime writes to plugin code directories can break updates, create permission issues, or introduce supply-chain risk.
How to Fix
- Store generated data in uploads, cache, or another WordPress-approved writable location.
- Validate paths and file names against strict allowlists.
- Avoid modifying plugin source files at runtime.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #601 | Mini Cart Drawer For WooCommerce | 80 | 4 | 25 | 400 | Non-prefixed hook name | ||
| #602 | ActivityPub | 81 | 67 | 303 | 6k+ | Non-prefixed global variable | ||
| #603 | Gutenverse Companion | 81 | 16 | 29 | 8k+ | Nonce verification recommended | ||
| #604 | Integration of Bitrix24 with Contact Form 7 | 83 | 14 | 40 | 600 | Non-prefixed function | ||
| #605 | PlugVersions – Easily roll back to previous versions of your plugins. | 83 | 9 | 6 | 1k+ | Request data is not unslashed | ||
| #606 | Object Cache 4 everyone | 87 | 2 | 65 | 5k+ | Non-prefixed function | ||
| #607 | Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More | 88 | 20 | 116 | 40k+ | Non-prefixed hook name | ||
| #608 | Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More | 89 | 14 | 20 | 2k+ | wp function not compatible with requires wp | ||
| #609 | Wetterwarner | 90 | 5 | 12 | 500 | Non-prefixed function | ||
| #610 | Loan Calculator WP | 91 | 20 | 5 | 2k+ | Non Singular String Literal Text | ||
| #611 | MultiManager WP – Manage All Your WordPress Sites Easily | 91 | 28 | 11 | 1k+ | Missing Arg Domain | ||
| #612 | BeyondSEO – AI SEO to Improve Rankings, Listings & Online Visibility | 93 | 7 | 36 | 2k+ | Non-prefixed global variable | ||
| #613 | WP Plugin Manager – Deactivate plugins per page | 94 | 18 | 11 | 3k+ | Missing direct file access protection | ||
| #614 | WebToffee Gift Cards for WooCommerce | 95 | 92 | 4 | 1k+ | wp function not compatible with requires wp | ||
| #615 | Aruba HiSpeed Cache | 97 | 12 | 5 | 100k+ | wp function not compatible with requires wp | ||
| #616 | Bit Social – Social Media Auto Poster and Scheduler | 98 | 10 | 1 | 6k+ | wp function not compatible with requires wp | ||
| #617 | Feeds for TikTok (TikTok feed, video, and gallery plugin) | 98 | 5 | 3 | 70k+ | Missing direct file access protection | ||
| #618 | Latest Post Shortcode | 98 | 5 | 6 | 4k+ | Non-prefixed constant | ||
| #619 | RootsPersona | 98 | 2 | 5 | 400 | Non-prefixed global variable | ||
| #620 | User Login History | 99 | 2 | 0 | 10k+ | Plugin Directory Write |
