PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_chmod

file system operations chmod

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#101teachPress237441,5872k+SQL query is not prepared
#102Travelpayouts237691106k+Output is not escaped
#103UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP236952,43420k+Non-prefixed hook name
#104Cart PDF for WooCommerce235311721k+Exception output is not escaped
#105Worth The Read238731383k+Text Domain Mismatch
#106WP Compress – Instant Performance & Speed Optimization233,0532,38410k+Non Singular String Literal Domain
#107WP Migrate Lite – Migration Made Easy23368254200k+Exception output is not escaped
#108WP STAGING – WordPress Backup, Restore & Migration231,4141,327100k+Non-prefixed global variable
#109WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel231,1193,51620k+Interpolated SQL is not prepared
#110Photo Engine (Media Organizer & Lightroom)232526502k+Direct Query
#111A2 Optimized WP – Turbocharge and secure your WordPress site2427123160k+Missing Arg Domain
#112AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress245,2301,4647k+Output is not escaped
#113All-In-One Security (AIOS) – Security and Firewall245521,2281m+Non-prefixed global variable
#114Backuply – Backup, Restore, Migrate and Clone24704551700k+Non-prefixed global variable
#115Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces242,2483,33810k+slow db query meta key
#116Bookit — Booking & Appointment Calendar245661,4564k+Non-prefixed global variable
#117Contact Form by Supsystic241,9136336k+Non Singular String Literal Domain
#118CRM Perks Forms – WordPress Form Builder248195771k+Output is not escaped
#119Defender Security – Malware Scanner, Login Security & Firewall2430651880k+Non-prefixed namespace
#120Doubly – Cross Domain Copy Paste for WordPress242525510k+Output is not escaped
#121Enable Media Replace24214276600k+Output is not escaped
#122Fast Velocity Minify2428225640k+Unsafe printing function
#123Featured Image from URL (FIFU)241,65441870k+Non Singular String Literal Domain
#124Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress2453632410k+Text Domain Mismatch
#125Assets manager, dequeue scripts, dequeue styles for WordPress245922552k+Output is not escaped
#126Simple Calendar – Google Calendar Plugin242,03559150k+Missing direct file access protection
#127Easy Google Maps241,76438920k+Non Singular String Literal Domain
#128Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN243,41086670k+Text Domain Mismatch
#129Import and export users and customers241,04635670k+Unsafe printing function
#130Social Slider Feed – Social Media Feed & Gallery Widgets2492970720k+Non-prefixed global variable
#131InstaWP Connect – 1-click WP Staging & Migration2425381140k+Non-prefixed global variable
#132Mang Board WP241,2494,7209k+Non-prefixed global variable
#133Media Library Folders2488980710k+Text Domain Mismatch
#134Page Builder: Pagelayer – Drag and Drop website builder24766555400k+Output is not escaped
#135Database Manager – WP Adminer241,0052,75220k+Non-prefixed global variable
#136PixelYourSite – Your smart PIXEL (TAG) & API Manager241,1602,407500k+Non-prefixed namespace
#137Premmerce Product Filter for WooCommerce248171,4862k+Non-prefixed global variable
#138ProfileGrid – User Profiles, Groups and Communities244732,4636k+Non-prefixed global variable
#139QuadMenu – Mega Menu242,12945510k+Output is not escaped
#140reGenerate Thumbnails Advanced2422012270k+Unsafe printing function
#141RSFirewall!245635214k+Output is not escaped
#142Security Plugin, Firewall & Malware Scanner with Auto Removal241,19277030k+Output is not escaped
#143Shortcodes Ultimate – Content Elements246561,552400k+Non-prefixed global variable
#144ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization2492632210k+Output is not escaped
#145SiteGuard WP Plugin24363345500k+Output is not escaped
#146Slideshow Gallery LITE248964145k+Output is not escaped
#147Social Media Auto Publish241,4687136k+Unsafe printing function
#148GEO Plugin by Squirrly SEO241,19622440k+Missing Translators Comment
#149Stripe Payment Forms by WP Simple Pay – Accept Credit Card Payments + Subscriptions with Stripe246346529k+Exception output is not escaped
#150Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!24167222400k+Nonce verification recommended