PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_fclose

file system operations fclose

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#601Database for Contact Form 7, WPforms, Elementor forms2631748960k+Non-prefixed global variable
#602ELEX WooCommerce Google Shopping (Google Product Feed)262262421k+Text Domain Mismatch
#603Event Monster – Event Manager, Ticket Booking & Registration26781781600Non-prefixed global variable
#604ezCache2612728410k+Direct Query
#605FG Drupal to WordPress26275100700Unsafe printing function
#606FG PrestaShop to WooCommerce2625494900Unsafe printing function
#607Fluent Support – Helpdesk & Customer Support Ticket System269227210k+Direct Query
#608Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager2611359790k+Non-prefixed global variable
#609FV Antispam26332239900Output is not escaped
#610Icegram Collect – Easy Form, Lead Collection and Subscription plugin264232922k+Output is not escaped
#611Integrate Razorpay for Contact Form 72615297500curl curl setopt
#612Kadence Central – Site Management, Backups, Security, and Reporting2646221330k+Text Domain Mismatch
#613Landing Page Cat – Coming Soon & Maintenance Pages2691180600Non-prefixed class
#614Login Widget With Shortcode263351986k+wp function not compatible with requires wp
#615Media File Renamer: Rename for better SEO (AI-Powered)2615417040k+Direct Query
#616Hotel Booking266909404k+Unsafe printing function
#617OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA)262725996k+Request data is not unslashed
#618Open User Map – Interactive Leaflet Maps2689598810k+Non-prefixed global variable
#619Paytium: Mollie payment forms & donations265065513k+Unsafe printing function
#620Crowdsignal Dashboard – Polls, Surveys & more26481491200k+Unsafe printing function
#621Pressidium Cookie Consent262039510k+Exception output is not escaped
#622Send Users Email – Email Subscribers, Email Marketing Newsletter261884155k+Non-prefixed global variable
#623SP Move Login268812156k+Text Domain Mismatch
#624Sliced Invoices – WordPress Invoice Plugin266844555k+Output is not escaped
#625URL Image Importer – Import External Images to the Media Library from URL, CSV & XML26143239700Missing nonce verification
#626User Avatar261041734k+Non-prefixed constant
#627User Submitted Posts – Enable Users to Submit Posts from the Front End2669939610k+Text Domain Mismatch
#628VikWidgetsLoader – Collection of Widgets261,2055351k+Output is not escaped
#629Visitors Online by BestWebSoft265122691k+Text Domain Mismatch
#630Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails2651325300k+Direct Query
#631HireZoot – Job Listings, Career Page & Recruitment Tool268062040k+Non-prefixed global variable
#632Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms277203675k+Text Domain Mismatch
#633WP Zoho for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms – CRM, Bigin276923813k+Text Domain Mismatch
#634Polls CP27399500400Output is not escaped
#635Cyrlitera – Transliteration of Links and File Names2745320440k+Output is not escaped
#636EZ SQL Reports Shortcode Widget and DB Backup27165158500Output is not escaped
#637Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin271221353k+Non-prefixed global variable
#638FG Joomla to WordPress272781017k+Unsafe printing function
#639Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin272124972k+Non-prefixed global variable
#640Login for Google Apps271398510k+Exception output is not escaped
#641GSpeech TTS – WordPress Text To Speech Plugin278423333k+Output is not escaped
#642Hester Core2725310310k+Output is not escaped
#643iQ Block Country2716424520k+Request data is not unslashed
#644Login Security Solution272161544k+Output is not escaped
#645LWS Optimize – All-in-One Speed Booster & Cache Tools273451810k+Non-prefixed global variable
#646MLSImport – Download and synchronize real estate data from various MLS (Multiple Listing Services)271545515k+Non-prefixed global variable
#647MW WP Form27334219200k+Output is not escaped
#648Nextend Social Login and Register271,668243200k+Output is not escaped
#649Tussendoor – Open RDW27301140600Text Domain Mismatch
#650Packlink PRO for WooCommerce2713216020k+Non-prefixed global variable