PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_chmod

file system operations chmod

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1BulletProof Security05,0484,94920k+Output is not escaped
#2Intercom060716k+Non-prefixed function
#3Live Shopping & Shoppable Videos For WooCommerce079174400Non-prefixed global variable
#4JetBackup – Backup, Restore & Migrate101,563149200k+Exception output is not escaped
#5RestroPress – Online Food Ordering System165363,2061k+Non-prefixed global variable
#6wpForo Forum174,3063,02620k+Unsafe printing function
#7Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution191,227892100k+Exception output is not escaped
#8Matomo Analytics – Powerful, Privacy-First Insights for WordPress191,900877100k+Exception output is not escaped
#9Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)195363793m+Missing Translators Comment
#10Membership Plugin – Kadence Memberships195,0832,9829k+Text Domain Mismatch
#11WP Import Export Lite1973797940k+Non-prefixed global variable
#12Brizy – Page Builder2058672670k+Output is not escaped
#13GiveWP – Donation Plugin and Fundraising Platform203,4103,554100k+Output is not escaped
#14GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership201,832720700Non Singular String Literal Domain
#15Leaky Paywall20322789600Nonce verification recommended
#16MBE eShip205277401k+Non-prefixed global variable
#17Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non-prefixed global variable
#18Pix por Piggly (para Woocommerce)205471954k+Exception output is not escaped
#19Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF20556543100k+Output is not escaped
#20Events Manager – OpenStreetMaps20559444600Output is not escaped
#21WP Compress – Instant Performance & Speed Optimization204,0883,51910k+Non Singular String Literal Domain
#22Backup Migration219991,08180k+Non-prefixed global variable
#23Kadence Security – Password, Two Factor Authentication, and Brute Force Protection211,060957700k+Missing Translators Comment
#24Booking Ultra Pro Appointments Booking Calendar Plugin217612,083400Request data is not unslashed
#25Captcha Them All213003235k+Output is not escaped
#26Comet Cache2185724520k+Output is not escaped
#27DELUCKS SEO213621,171400Missing nonce verification
#28Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More212,5721,2771m+Output is not escaped
#29FileOrganizer – WordPress File Manager21536241200k+unlink unlink
#30Filter Everything — WordPress & WooCommerce Filters2164393350k+Non-prefixed global variable
#31Campaign Monitor for WordPress213864612k+Non-prefixed global variable
#32Modular DS: Monitor, update, and backup multiple websites211918240k+Exception output is not escaped
#33Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction211,9915,32310k+Non-prefixed hook name
#34User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor217361,50640k+Nonce verification recommended
#35Royal Addons for Elementor – Addons and Templates Kit for Elementor2112,9912,414600k+Text Domain Mismatch
#36Smart Forms – when you need more than just a contact form217765745k+Output is not escaped
#37UPC/EAN/GTIN Barcode Generator/Importer21776311500Exception output is not escaped
#38Buckaroo Woocommerce Payments Plugin216383212k+Exception output is not escaped
#39WebP Express21160427300k+Non-prefixed global variable
#40Wordfence Security – Firewall, Malware Scan, and Login Security211,8183,2365m+Output is not escaped
#41wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin211,8341,53070k+Output is not escaped
#42WP Extended – The Ultimate WordPress Toolkit211,253398600Non Singular String Literal Domain
#43All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos229122,88520k+Non-prefixed global variable
#44ANAC XML Bandi di Gara22294244500Output is not escaped
#45Borderless – Addons and Templates for Elementor224381,3885k+Non-prefixed global variable
#46Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8541,26950k+Text Domain Mismatch
#47Code Profiler – WordPress Performance Profiling and Debugging Made Easy222654008k+Non-prefixed global variable
#48Accept PayPal Payments using Contact Form 722359127600Text Domain Mismatch
#49RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login223,6525,1458k+Non-prefixed global variable
#50Database Access with Adminer229832,5531k+Non-prefixed global variable