PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_fclose

file system operations fclose

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#501Booking Package251,6973,97710k+Missing nonce verification
#502Bookit — Booking & Appointment Calendar255651,4584k+Non-prefixed global variable
#503Breeze Cache25218800400k+Non-prefixed global variable
#504Broken Link Checker25727600500k+Output is not escaped
#505CheckoutWC Lite – Conversion optimized WooCommerce checkout251,4168543k+Text Domain Mismatch
#506CheckView – Form & Checkout Testing25663371k+Direct Query
#507Colissimo shipping methods for WooCommerce251,75555710k+Text Domain Mismatch
#508Disable Comments & Delete All Comments255031859k+Output is not escaped
#509Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress254983551k+Text Domain Mismatch
#510Contact Form Email254098989k+Non-prefixed global variable
#511Coupon Creator256984121k+Output is not escaped
#512Smash Balloon Social Post Feed – Simple Social Feeds for WordPress25554982200k+Output is not escaped
#513DecaLog259432361k+Exception output is not escaped
#514Disable Admin Notices – Hide Dashboard Notifications25465195100k+Output is not escaped
#515Docket Cache – Object Cache Accelerator2533348120k+Output is not escaped
#516WEB-Translation – eTranslation Multilingual252171,057400Non-prefixed function
#517Events Made Easy255216,3241k+Non-prefixed function
#518Form Vibes – Save Contact Form 7 & Elementor Form Entries to Database257161,50910k+Non-prefixed global variable
#519Gallery Images Ape255883411k+Output is not escaped
#520GD Rating System251,5111,0431k+Output is not escaped
#521GD Security Headers254075211k+Output is not escaped
#522GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content25888636k+Non-prefixed global variable
#523WPBruiser {no- Captcha anti-Spam}2564625910k+Non Singular String Literal Domain
#524Site Kit by Google – Analytics, Search Console, AdSense, Speed251,3042425m+Missing direct file access protection
#525Sitemap by BestWebSoft – WordPress XML Site Map Page Generator Plugin2560820720k+Text Domain Mismatch
#526Hydra Booking — Appointment Scheduling & Booking Calendar252356992k+Non-prefixed global variable
#527Independent Analytics – WordPress Analytics Plugin251,1482,293100k+Non-prefixed global variable
#528Index WP MySQL For Speed2525025550k+Output is not escaped
#529IP Location Block2552162410k+Output is not escaped
#530IP Locator25482211600Text Domain Mismatch
#531JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin251,5411,5781k+Non-prefixed global variable
#532Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more254,0191,2652k+Text Domain Mismatch
#533Local Pickup for WooCommerce255471,3891k+Non-prefixed global variable
#534Loginizer258145041m+Output is not escaped
#535M Chart255581,4653k+Non-prefixed global variable
#536MaxButtons – Create buttons2562640470k+Output is not escaped
#537Media Cleaner: Clean your WordPress!2526354690k+Direct Query
#538Media Cloud Sync251,0952741k+Exception output is not escaped
#539Create251,6377646k+Text Domain Mismatch
#540All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements2535259740k+Non-prefixed global variable
#541Paymob for WooCommerce254433505k+Text Domain Mismatch
#542PDF Importer for WPForms25332329400Non-prefixed global variable
#543PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin251,0841,2969k+Non-prefixed global variable
#544phpinfo() WP — Site Health, PHP Compatibility & Server Audit252767043k+Non-prefixed global variable
#545Piotnet Forms251873743k+Alternative PHP tag found
#546Post Snippets – Custom WordPress Code Snippets Customizer258081,65420k+Non-prefixed global variable
#547Pz-LinkCard259541,61820k+Non-prefixed global variable
#548Quttera ThreatSign – Web Malware Scanner for WordPress2533447110k+Non-prefixed global variable
#549reSmush.it : The original free image compressor and optimizer plugin2515569100k+Output is not escaped
#550BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript252045464k+Non-prefixed global variable