WordPress.WP.AlternativeFunctions.file_system_operations_chmod
file system operations chmod
The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.
Why It Shows Up
Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.
Why It Matters
WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.
How to Fix
- Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
- Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
- Never write PHP code from user input or remote responses.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #51 | Directorist: AI-Powered Business Directory, Listings & Classified Ads | 22 | 560 | 2,202 | 20k+ | Non-prefixed global variable | ||
| #52 | Download Manager | 22 | 2,444 | 1,489 | 100k+ | Output is not escaped | ||
| #53 | E2Pdf – Export Pdf Tool for WordPress | 22 | 1,081 | 847 | 10k+ | Unsafe printing function | ||
| #54 | Ebook Store | 22 | 410 | 1,054 | 700 | Non-prefixed global variable | ||
| #55 | File Manager Pro – Filester | 22 | 566 | 391 | 100k+ | Request data is not unslashed | ||
| #56 | The Innovative Form Builder – IvyForms | 22 | 750 | 309 | 900 | Exception output is not escaped | ||
| #57 | MasterStudy LMS WordPress Plugin – for Online Courses and Education | 22 | 1,444 | 4,879 | 10k+ | Non-prefixed global variable | ||
| #58 | Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization | 22 | 1,359 | 2,800 | 8k+ | Output is not escaped | ||
| #59 | Modula Image Gallery – Photo Grid & Video Gallery | 22 | 472 | 437 | 100k+ | Text Domain Mismatch | ||
| #60 | Motors – Car Dealership & Classified Listings Plugin | 22 | 5,391 | 6,082 | 9k+ | Text Domain Mismatch | ||
| #61 | MultiParcels Shipping For WooCommerce | 22 | 242 | 422 | 4k+ | Request data is not unslashed | ||
| #62 | Newsletters | 22 | 2,977 | 2,261 | 2k+ | Text Domain Mismatch | ||
| #63 | Packeta | 22 | 801 | 333 | 8k+ | Exception output is not escaped | ||
| #64 | PDF Builder for WPForms | 22 | 321 | 268 | 900 | SQL query is not prepared | ||
| #65 | Smart Popup by Supsystic | 22 | 3,028 | 439 | 10k+ | Non Singular String Literal Domain | ||
| #66 | Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | 22 | 1,581 | 2,326 | 300k+ | Non-prefixed global variable | ||
| #67 | PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP | 22 | 984 | 407 | 5k+ | Unsafe printing function | ||
| #68 | RealPress – Real Estate Plugin | 22 | 604 | 1,167 | 400 | Non-prefixed global variable | ||
| #69 | ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF | 22 | 1,044 | 800 | 300k+ | Non-prefixed global variable | ||
| #70 | Simple Job Board | 22 | 634 | 1,355 | 10k+ | Non-prefixed global variable | ||
| #71 | Unlimited Elements Blocks Library | 22 | 708 | 1,822 | 400 | Non-prefixed global variable | ||
| #72 | RapidLoad AI – Optimize Web Vitals Automatically | 22 | 81 | 840 | 700 | Nonce verification recommended | ||
| #73 | Wenprise WeChatPay Payment Gateway For WooCommerce | 22 | 443 | 178 | 400 | Exception output is not escaped | ||
| #74 | WooCommerce | 22 | 1,343 | 6,210 | 7m+ | Non-prefixed global variable | ||
| #75 | File Manager | 22 | 740 | 520 | 1m+ | Unsafe printing function | ||
| #76 | WP Umbrella: Security Backup Restore & Monitoring | 22 | 970 | 995 | 80k+ | Exception output is not escaped | ||
| #77 | WP-WebAuthn | 22 | 957 | 396 | 2k+ | Exception output is not escaped | ||
| #78 | WPSSO Core – Complete Schema Markup and Meta Tags | 22 | 1,408 | 414 | 4k+ | Missing Translators Comment | ||
| #79 | YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports | 22 | 654 | 435 | 10k+ | Exception output is not escaped | ||
| #80 | ЮKassa для WooCommerce | 22 | 591 | 167 | 9k+ | Short PHP open tag found | ||
| #81 | Affiliate Super Assistent | 23 | 1,280 | 267 | 1k+ | Text Domain Mismatch | ||
| #82 | Content Egg – Affiliate Product Importer & Price Comparison | 23 | 1,532 | 1,385 | 10k+ | Non-prefixed global variable | ||
| #83 | Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe | 23 | 9,396 | 26,680 | 1k+ | Non-prefixed global variable | ||
| #84 | CWW Companion | 23 | 307 | 223 | 1k+ | Output is not escaped | ||
| #85 | DK PDF – WordPress PDF Generator | 23 | 744 | 335 | 3k+ | Exception output is not escaped | ||
| #86 | Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | 23 | 3,702 | 8,486 | 40k+ | Non-prefixed namespace | ||
| #87 | Error Log Monitor | 23 | 694 | 1,414 | 20k+ | Non-prefixed global variable | ||
| #88 | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | 23 | 397 | 1,365 | 90k+ | Non-prefixed global variable | ||
| #89 | GAinWP Google Analytics Integration for WordPress | 23 | 525 | 176 | 8k+ | Output is not escaped | ||
| #90 | Anti-Malware Security and Brute-Force Firewall | 23 | 543 | 965 | 100k+ | Output is not escaped | ||
| #91 | Gmedia Photo Gallery | 23 | 350 | 1,121 | 7k+ | Non-prefixed global variable | ||
| #92 | Heureka | 23 | 534 | 237 | 400 | Exception output is not escaped | ||
| #93 | InfiniteWP Client | 23 | 2,379 | 1,844 | 200k+ | Exception output is not escaped | ||
| #94 | Kenta Companion | 23 | 657 | 1,419 | 2k+ | Non-prefixed global variable | ||
| #95 | License Manager for WooCommerce | 23 | 131 | 805 | 6k+ | Nonce verification recommended | ||
| #96 | Master Slider – Responsive Touch Slider | 23 | 800 | 408 | 60k+ | Output is not escaped | ||
| #97 | Media Library Assistant | 23 | 1,130 | 3,813 | 70k+ | Nonce verification recommended | ||
| #98 | MediaPress | 23 | 904 | 583 | 3k+ | Output is not escaped | ||
| #99 | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider | 23 | 204 | 324 | 500k+ | Non-prefixed global variable | ||
| #100 | News Kit Addons For Elementor | 23 | 69 | 419 | 4k+ | Post Not In exclude |
