PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_chmod

file system operations chmod

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#201DecaLog259432361k+Exception output is not escaped
#202Docket Cache – Object Cache Accelerator2533348120k+Output is not escaped
#203Featured Image from URL (FIFU)252,0301,00970k+Non Singular String Literal Domain
#204Site Kit by Google – Analytics, Search Console, AdSense, Speed251,3182425m+Missing direct file access protection
#205Sitemap by BestWebSoft – WordPress XML Site Map Page Generator Plugin2560820720k+Text Domain Mismatch
#206Infinite Uploads – Offload, Optimize & Organize Your Media Library25584713800Text Domain Mismatch
#207Media Cloud Sync251,0972751k+Exception output is not escaped
#208Ocean Extra251,4892,112500k+Non-prefixed global variable
#209PDF Importer for WPForms25332331400Non-prefixed global variable
#210PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin251,0841,2969k+Non-prefixed global variable
#211Piotnet Forms251873742k+Alternative PHP tag found
#212QuadMenu – Mega Menu252,12845510k+Output is not escaped
#213reSmush.it : The original free image compressor and optimizer plugin2515569100k+Output is not escaped
#214Simply Static – The Static Site Generator2518953530k+Non-prefixed hook name
#215Affiliate Program Suite — SliceWP Affiliates251,2912,08910k+Output is not escaped
#216TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder257051,58710k+Non-prefixed global variable
#217VikAppointments Services Booking Calendar259,7595,209500Output is not escaped
#218VikBooking Hotel Booking Engine & PMS2513,2518,3168k+Output is not escaped
#219VikRentCar Car Rental Management System255,5375,0484k+Non-prefixed global variable
#220VikRentItems Flexible Rental Management System254,7674,640600Non-prefixed global variable
#221VikRestaurants Table Reservations and Take-Away2511,6444,932600Output is not escaped
#222PDF Ink Lite – Free PDF Watermark & Password Protection252075952k+Non-prefixed global variable
#223PDF Builder for WooCommerce. Create invoices,packing slips and more253725062k+Non-prefixed global variable
#224WordPress Importer252381102m+Output is not escaped
#225Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF2515712860k+Non-prefixed global variable
#226SlimStat Analytics251,17787070k+Exception output is not escaped
#227Smush – Image Optimization, Compression, Lazy Load, WebP & CDN252445691m+Non-prefixed hook name
#228WP Super Cache258009891m+Output is not escaped
#229WPvivid — Backup, Migration & Staging259031,461900k+Non-prefixed namespace
#230Backup, Restore and Migrate your sites with XCloner2523886410k+Input is not sanitized
#231Database for Contact Form 7, WPforms, Elementor forms2631748960k+Non-prefixed global variable
#232Cyrlitera – Transliteration of Links and File Names2645220240k+Output is not escaped
#233Portfolio by BestWebSoft – Work and Projects Presentation Plugin for WordPress26525240600Text Domain Mismatch
#234SP Move Login268812156k+Text Domain Mismatch
#235Attesa Extra273151511k+Output is not escaped
#236Login for Google Apps271398510k+Exception output is not escaped
#237Mihdan: Ajax Edit Comments271,300523400Text Domain Mismatch
#238Vertex Addons for Elementor28232413400Output is not escaped
#239FAPI Member28279153500Exception output is not escaped
#240Kama Thumbnail2880479k+Output is not escaped
#241Sparkle Demo Importer283071665k+Text Domain Mismatch
#242Ultimate Watermark – Image Watermark, Image Protection & Bulk Watermarking281613021k+Nonce verification recommended
#243AI Copilot – Content Generator29803221k+Direct Query
#244CloudSecure WP Security2974334100k+Request data is not unslashed
#245DB Cache Reloaded Fix29133422k+Output is not escaped
#246Di Themes Demo Site Importer293431831k+Text Domain Mismatch
#247Event Tickets Manager for WooCommerce291826571k+Non-prefixed global variable
#248Easy HTTPS Redirection (SSL)29266152100k+Unsafe printing function
#249Kits, Templates and Patterns29380914k+Text Domain Mismatch
#250SheetsPilot – AI Spreadsheet Bulk Edit for Posts, WooCommerce Products & SEO298055400unlink unlink