PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_chmod

file system operations chmod

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#101News Kit Addons For Elementor23694194k+Post Not In exclude
#102Next Active Directory Integration236832842k+Exception output is not escaped
#103Print Anywhere & Create PDFs of Order Receipts, Invoices, Labels & More.231,4854441k+Text Domain Mismatch
#104Print My Blog – Print, PDF, & eBook Converter WordPress Plugin231,0771,6609k+Non-prefixed global variable
#105Local Google Analytics for WordPress – caches external requests235511993k+Output is not escaped
#106Image Optimizer, Resizer and CDN – Sirv236141,0041k+Output is not escaped
#107Site Reviews231,38060160k+Output is not escaped
#108Smart Slider 323263268800k+Non-prefixed global variable
#109Strong Testimonials2319940290k+Nonce verification recommended
#110teachPress237441,5872k+SQL query is not prepared
#111Travelpayouts237611146k+Output is not escaped
#112UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP236972,43820k+Non-prefixed hook name
#113Cart PDF for WooCommerce235311721k+Exception output is not escaped
#114ManageWP Worker235015701m+Non-prefixed class
#115Worth The Read238731383k+Text Domain Mismatch
#116WP Migrate Lite – Migration Made Easy23371257200k+Exception output is not escaped
#117WP STAGING – WordPress Backups, Restore, Migration & Clone231,5451,725100k+Non-prefixed global variable
#118WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell236,0192,7735k+Text Domain Mismatch
#1191 Click Migration & Backup: Free WordPress Migration Plugin with Zero Downtime & Easy Clone24140193400Direct Query
#120A2 Optimized WP – Turbocharge and secure your WordPress site2427123160k+Missing Arg Domain
#121All-In-One Security (AIOS) – Security and Firewall245521,2281m+Non-prefixed global variable
#122Backuply – Backup, Restore, Migrate and Clone24711556600k+Non-prefixed global variable
#123Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces242,4503,40510k+slow db query meta key
#124Contact Form by Supsystic241,7646136k+Non Singular String Literal Domain
#125CRM Perks Forms – WordPress Form Builder248195771k+Output is not escaped
#126Custom CSS247036571k+Output is not escaped
#127WP Customer Area243,30694110k+Text Domain Mismatch
#128Defender Security – Malware Scanner, Login Security & Firewall2455059380k+Non-prefixed namespace
#129Disable Admin Notices – Hide Dashboard Notifications24464195100k+Output is not escaped
#130Doubly – Cross Domain Copy Paste for WordPress242525510k+Output is not escaped
#131Easy Invoice – Invoice Generator, PDF Quotes & Payments241,3662,013600Non-prefixed global variable
#132Easy Optimizer – PageSpeed, Cache & Core Web Vitals (Unused CSS, Delay JS, Lazy Load)24209521700Direct Query
#133Enable Media Replace24212276600k+Output is not escaped
#134Export WordPress Pages to Static HTML & PDF — Static Site Export245093044k+Text Domain Mismatch
#135F12 Profiler24282451500Direct Query
#136Fast Velocity Minify2428325440k+Unsafe printing function
#137Fattura2424313335400Output is not escaped
#138Formidable PRO2PDF242184771k+Non-prefixed global variable
#139Fuse Social Floating Sidebar241,8381,57810k+Non-prefixed global variable
#140Futurio Extra2478620520k+Text Domain Mismatch
#141Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress2454032210k+Text Domain Mismatch
#142Assets manager, dequeue scripts, dequeue styles for WordPress245922552k+Output is not escaped
#143Simple Calendar – Google Calendar Plugin242,14761150k+Missing direct file access protection
#144Easy Google Maps241,65239620k+Non Singular String Literal Domain
#145Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN243,40886670k+Text Domain Mismatch
#146Import and export users and customers241,02836070k+Unsafe printing function
#147Social Slider Feed – Social Media Feed & Gallery Widgets2492770610k+Non-prefixed global variable
#148InstaWP Connect – 1-click WP Staging & Migration2425481540k+Non-prefixed global variable
#149Dynamics 365 Integration24383166600Output is not escaped
#150Kirki – Freeform Page Builder, Website Builder & Customizer24222816500k+Exception output is not escaped