PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_chmod

file system operations chmod

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#151Mang Board WP241,2154,7358k+Non-prefixed global variable
#152Media Library Folders2489280710k+Text Domain Mismatch
#153Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery242,1541,035300k+Text Domain Mismatch
#154Omnipress24169245800Non-prefixed global variable
#155Page Builder: Pagelayer – Drag and Drop website builder24829569400k+Output is not escaped
#156PDF Generator for WordPress Elementor245132711k+Exception output is not escaped
#157Database Manager – WP Adminer241,0052,75220k+Non-prefixed global variable
#158PixelYourSite – Your smart PIXEL (TAG) & API Manager241,5782,901500k+Non-prefixed namespace
#159Post Status Notifier Lite24984451700Missing direct file access protection
#160Premmerce Product Filter for WooCommerce248171,4862k+Non-prefixed global variable
#161Pricing Table by Supsystic241,22744010k+Non Singular String Literal Domain
#162ProfileGrid – User Profiles, Groups and Communities244832,4635k+Non-prefixed global variable
#163Quttera ThreatSign – Web Malware Scanner for WordPress2433547210k+Non-prefixed global variable
#164reGenerate Thumbnails Advanced2422012260k+Unsafe printing function
#165RSFirewall!245635214k+Output is not escaped
#166SecuPress with Simple SSL – Simple and Performant Security241,6951,60040k+Non-prefixed global variable
#167Security Plugin, Firewall & Malware Scanner with Auto Removal241,15681340k+SQL query is not prepared
#168Shortcodes Ultimate – Content Elements246561,552400k+Non-prefixed global variable
#169ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization2492632210k+Output is not escaped
#170SiteGuard WP Plugin24363335600k+Output is not escaped
#171Slideshow Gallery LITE248964145k+Output is not escaped
#172Social Media Auto Publish241,4687136k+Unsafe printing function
#173Softaculous241155010k+file system operations fread
#174GEO Plugin by Squirrly SEO241,19123130k+Missing Translators Comment
#175Stripe Payment Forms by WP Simple Pay – Accept Credit Card Payments + Subscriptions with Stripe246346528k+Exception output is not escaped
#176Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers243611,4831k+Nonce verification recommended
#177Tamara Checkout246032362k+Exception output is not escaped
#178Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!24174238300k+Nonce verification recommended
#179Ultimate Maps by Supsystic2493936810k+Non Singular String Literal Domain
#180User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder246663,40450k+Non-prefixed global variable
#181Disable Updates – Updates Manager, Disable Automatic Updates, Disable All Updates2452113410k+Output is not escaped
#182EU VAT Assistant for WooCommerce241,7424955k+Non Singular String Literal Domain
#183WPML Multilingual & Multicurrency for WooCommerce241,5991,691100k+SQL query is not prepared
#184WP-Appbox244183902k+Missing Arg Domain
#185WP Discourse241021141k+Nonce verification recommended
#186WP Review Slider241,6362,5436k+Non-prefixed global variable
#187WP Travel – Ultimate Travel Booking System, Tour Management Engine242291,9624k+Non-prefixed hook name
#188WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import241,1963,89820k+Direct Query
#189Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export242891,0526k+Direct Query
#190Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress242,5822,109100k+Output is not escaped
#191WPAdverts – Classifieds Plugin241,3084964k+Output is not escaped
#192Photo Engine (Media Organizer & Lightroom)242536452k+Direct Query
#193Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation241,2113,15730k+Non-prefixed global variable
#194ActiveCampaign for WooCommerce255661945k+Non Singular String Literal Domain
#195AliNext – WooCommerce Dropshipping Plugin for AliExpress255557344k+Text Domain Mismatch
#196ATUM WooCommerce Inventory Management and Stock Tracking252,6111,29610k+Non Singular String Literal Domain
#197Bookit — Booking & Appointment Calendar255651,4614k+Non-prefixed global variable
#198Kognetiks Chatbot for WordPress256811,510600Non-prefixed global variable
#199CheckoutWC Lite – Conversion optimized WooCommerce checkout251,4208572k+Text Domain Mismatch
#200Disable Comments & Delete All Comments255021849k+Output is not escaped