PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_chmod

file system operations chmod

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#151Unlimited Elements For Elementor247102,093300k+Non-prefixed global variable
#152User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder246643,31860k+Non-prefixed global variable
#153PDF Ink Lite – Free PDF Watermark & Password Protection242265612k+Non-prefixed global variable
#154Disable Updates – Updates Manager, Disable Automatic Updates, Disable All Updates2452213510k+Output is not escaped
#155EU VAT Assistant for WooCommerce241,7424955k+Non Singular String Literal Domain
#156WPML Multilingual & Multicurrency for WooCommerce241,4531,618100k+SQL query is not prepared
#157WP-Appbox244183902k+Missing Arg Domain
#158SlimStat Analytics241,16973770k+Exception output is not escaped
#159WP Travel – Ultimate Travel Booking System, Tour Management Engine242261,9514k+Non-prefixed hook name
#160Export All Posts, Products, Orders, Refunds & Users243631,1307k+Direct Query
#161Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress242,5762,103100k+Output is not escaped
#162WPAdverts – Classifieds Plugin241,3084965k+Output is not escaped
#163Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation241,2113,15230k+Non-prefixed global variable
#164AliExpress Dropshipping Plugin for WooCommerce Stores255507284k+Text Domain Mismatch
#165ATUM WooCommerce Inventory Management and Stock Tracking252,6381,30410k+Non Singular String Literal Domain
#166CheckoutWC Lite251,3598503k+Text Domain Mismatch
#167Disable Comments & Delete All Comments255031859k+Output is not escaped
#168DecaLog259432361k+Exception output is not escaped
#169Disable Admin Notices – Hide Dashboard Notifications25465195100k+Output is not escaped
#170Docket Cache – Object Cache Accelerator2533348120k+Output is not escaped
#171Site Kit by Google – Analytics, Search Console, AdSense, Speed251,3042425m+Missing direct file access protection
#172Sitemap by BestWebSoft – WordPress XML Site Map Page Generator Plugin2560820720k+Text Domain Mismatch
#173LWS Optimize – All-in-One Speed Booster & Cache Tools2543076420k+Non-prefixed global variable
#174PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin251,0841,2969k+Non-prefixed global variable
#175Piotnet Forms251873743k+Alternative PHP tag found
#176Quttera ThreatSign – Web Malware Scanner for WordPress2533447110k+Non-prefixed global variable
#177reSmush.it : The original free image compressor and optimizer plugin2515569100k+Output is not escaped
#178Simply Static – The Static Site Generator2516344630k+Non-prefixed hook name
#179Affiliate Program Suite — SliceWP Affiliates251,2912,08910k+Output is not escaped
#180Tamara Checkout256012282k+Exception output is not escaped
#181TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder257051,58710k+Non-prefixed global variable
#182VikBooking Hotel Booking Engine & PMS2513,2328,3128k+Output is not escaped
#183VikRentCar Car Rental Management System255,5375,0484k+Non-prefixed global variable
#184PDF Builder for WooCommerce. Create invoices,packing slips and more253725032k+Non-prefixed global variable
#185WordPress Importer252381102m+Output is not escaped
#186WP Review Slider251,1862,2796k+Non-prefixed global variable
#187Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF2515411860k+Non-prefixed global variable
#188Smush – Image Optimization, Compression, Lazy Load, WebP & CDN252525661m+Non-prefixed hook name
#189WP Super Cache258009891m+Output is not escaped
#190WPvivid — Backup, Migration & Staging258991,461900k+Non-prefixed namespace
#191Backup, Restore and Migrate your sites with XCloner2523886410k+Input is not sanitized
#192ActiveCampaign for WooCommerce265411906k+Exception output is not escaped
#193Database for Contact Form 7, WPforms, Elementor forms2631748960k+Non-prefixed global variable
#194SP Move Login268812156k+Text Domain Mismatch
#195Cyrlitera – Transliteration of Links and File Names2745320440k+Output is not escaped
#196Login for Google Apps271398510k+Exception output is not escaped
#197WP-DBManager2738630460k+Non-prefixed global variable
#198Kama Thumbnail2880479k+Output is not escaped
#199Sparkle Demo Importer283071666k+Text Domain Mismatch
#200CloudSecure WP Security2974350100k+Request data is not unslashed