PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_chmod

file system operations chmod

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1BulletProof Security05,0484,94920k+Output is not escaped
#2Intercom060716k+Non-prefixed function
#3Live Shopping & Shoppable Videos For WooCommerce078175400Non-prefixed global variable
#4JetBackup – Backup, Restore & Migrate101,563149200k+Exception output is not escaped
#5wpForo Forum174,0332,92220k+Unsafe printing function
#6Realtyna Organic IDX plugin + WPL Real Estate189303,6362k+Non-prefixed global variable
#7RestroPress – Online Food Ordering System185213,0821k+Non-prefixed global variable
#8Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution191,218901100k+Exception output is not escaped
#9Matomo Analytics – Powerful, Privacy-First Insights for WordPress191,911877100k+Exception output is not escaped
#10Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)195403893m+Missing Translators Comment
#11Membership Plugin – Kadence Memberships195,0822,9829k+Text Domain Mismatch
#12WP Import Export Lite1973797940k+Non-prefixed global variable
#13Brizy – Page Builder2058972070k+Output is not escaped
#14Filter Everything — WordPress & WooCommerce Filters2056873050k+Output is not escaped
#15GiveWP – Donation Plugin and Fundraising Platform203,4283,559100k+Output is not escaped
#16GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership201,832720800Non Singular String Literal Domain
#17Leaky Paywall20320782700Nonce verification recommended
#18MBE eShip205277401k+Non-prefixed global variable
#19Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization201,2972,6809k+Output is not escaped
#20Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non-prefixed global variable
#21Pix por Piggly (para Woocommerce)205471954k+Exception output is not escaped
#22Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF20557541100k+Output is not escaped
#23Events Manager – OpenStreetMaps20559444700Output is not escaped
#24Backup Migration219811,09380k+Non-prefixed global variable
#25Booking Ultra Pro Appointments Booking Calendar Plugin217612,083400Request data is not unslashed
#26Captcha Them All213003236k+Output is not escaped
#27Comet Cache2185724520k+Output is not escaped
#28DELUCKS SEO213621,171400Missing nonce verification
#29Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More212,5721,2771m+Output is not escaped
#30FileOrganizer – WordPress File Manager21536241200k+unlink unlink
#31Campaign Monitor for WordPress213864612k+Non-prefixed global variable
#32Modular DS: Monitor, update, and backup multiple websites211598140k+Exception output is not escaped
#33Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction211,9345,24810k+Non-prefixed hook name
#34User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor217011,46550k+Missing Translators Comment
#35Royal Addons for Elementor – Addons and Templates Kit for Elementor2113,0112,530600k+Text Domain Mismatch
#36Smart Forms – when you need more than just a contact form217765745k+Output is not escaped
#37UPC/EAN/GTIN Barcode Generator/Importer21776311500Exception output is not escaped
#38Buckaroo Woocommerce Payments Plugin215843262k+Exception output is not escaped
#39WebP Express21160427300k+Non-prefixed global variable
#40Wordfence Security – Firewall, Malware Scan, and Login Security211,5922,9735m+Output is not escaped
#41WP Compress – Instant Performance & Speed Optimization213,3673,25310k+Non Singular String Literal Domain
#42wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin211,8111,43270k+Output is not escaped
#43WP Extended – The Ultimate WordPress Toolkit211,253398600Non Singular String Literal Domain
#44All-in-One Video Gallery229112,89220k+Non-prefixed global variable
#45ANAC XML Bandi di Gara22294244600Output is not escaped
#46Borderless – Addons and Templates for Elementor224381,3885k+Non-prefixed global variable
#47Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8581,27050k+Text Domain Mismatch
#48Code Profiler – WordPress Performance Profiling and Debugging Made Easy222654008k+Non-prefixed global variable
#49Accept PayPal Payments using Contact Form 722359127600Text Domain Mismatch
#50RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login223,6535,0788k+Non-prefixed global variable