WordPress.WP.AlternativeFunctions.file_system_operations_fclose
file system operations fclose
The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.
Why It Shows Up
Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.
Why It Matters
WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.
How to Fix
- Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
- Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
- Never write PHP code from user input or remote responses.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #651 | Rate My Post – Star Rating Plugin by FeedbackWP | 27 | 222 | 360 | 20k+ | Output is not escaped | ||
| #652 | Robokassa payment gateway for Woocommerce | 27 | 95 | 211 | 3k+ | Non-prefixed global variable | ||
| #653 | Sign-up Sheets | 27 | 325 | 363 | 1k+ | Output is not escaped | ||
| #654 | Simple Download Monitor | 27 | 218 | 273 | 20k+ | Output is not escaped | ||
| #655 | Social Web Suite – Social Media Auto Post, Social Media Auto Publish | 27 | 74 | 164 | 500 | Non-prefixed global variable | ||
| #656 | Speed Booster Pack ⚡ PageSpeed Optimization Suite | 27 | 108 | 187 | 9k+ | Missing Translators Comment | ||
| #657 | Stream Video Player | 27 | 220 | 135 | 600 | Output is not escaped | ||
| #658 | Theme One Click Demo Importer | 27 | 210 | 157 | 500 | Text Domain Mismatch | ||
| #659 | Verge3D Publishing and E-Commerce | 27 | 245 | 298 | 400 | Nonce verification recommended | ||
| #660 | Wiremo – Product Reviews for WooCommerce | 27 | 445 | 212 | 700 | Output is not escaped | ||
| #661 | Mihdan: Ajax Edit Comments | 27 | 1,300 | 523 | 400 | Text Domain Mismatch | ||
| #662 | WP-DBManager | 27 | 386 | 304 | 60k+ | Non-prefixed global variable | ||
| #663 | WP Events Manager | 27 | 294 | 415 | 30k+ | Output is not escaped | ||
| #664 | WP Hide & Security Enhancer | 27 | 124 | 375 | 50k+ | Input is not sanitized | ||
| #665 | wp-mpdf | 27 | 123 | 382 | 1k+ | Non-prefixed global variable | ||
| #666 | WP Activity Log | 27 | 96 | 230 | 300k+ | Nonce verification recommended | ||
| #667 | Worthy – VG WORT Integration für WordPress | 27 | 1,343 | 773 | 1k+ | Output is not escaped | ||
| #668 | WPBase Cache | 27 | 189 | 113 | 2k+ | Text Domain Mismatch | ||
| #669 | Redirection for Contact Form 7 | 27 | 34 | 374 | 200k+ | Non-prefixed global variable | ||
| #670 | Vertex Addons for Elementor | 28 | 232 | 413 | 400 | Output is not escaped | ||
| #671 | Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms | 28 | 632 | 351 | 800 | Text Domain Mismatch | ||
| #672 | Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms | 28 | 649 | 357 | 9k+ | Text Domain Mismatch | ||
| #673 | WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms | 28 | 659 | 359 | 400 | Text Domain Mismatch | ||
| #674 | Code Engine – PHP Snippets, AI Functions & Automation for WordPress | 28 | 124 | 96 | 700 | Non Singular String Literal Domain | ||
| #675 | Maspik – Ultimate Spam Protection | 28 | 212 | 862 | 30k+ | Missing nonce verification | ||
| #676 | Database Cleaner | 28 | 137 | 297 | 10k+ | Direct Query | ||
| #677 | Dynamic User Directory | 28 | 403 | 256 | 1k+ | Output is not escaped | ||
| #678 | Educare – Students & Result Management System | 28 | 1,114 | 1,043 | 800 | Missing nonce verification | ||
| #679 | Event Tickets Manager for WooCommerce | 28 | 182 | 655 | 1k+ | Non-prefixed global variable | ||
| #680 | Expand Divi | 28 | 91 | 100 | 1k+ | Non-prefixed global variable | ||
| #681 | Reviews and Rating – Google Reviews | 28 | 343 | 219 | 20k+ | Text Domain Mismatch | ||
| #682 | Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery | 28 | 384 | 175 | 10k+ | Text Domain Mismatch | ||
| #683 | Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms | 28 | 641 | 348 | 1k+ | Text Domain Mismatch | ||
| #684 | Laposta Signup Basic | 28 | 276 | 67 | 2k+ | Output is not escaped | ||
| #685 | درگاه پرداخت بانک ملت ووکامرس | 28 | 61 | 130 | 2k+ | Request data is not unslashed | ||
| #686 | MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor | 28 | 62 | 246 | 600k+ | Non-prefixed global variable | ||
| #687 | My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu) | 28 | 164 | 441 | 100k+ | Non-prefixed global variable | ||
| #688 | Perfect Brands for WooCommerce | 28 | 112 | 143 | 40k+ | Non-prefixed constant | ||
| #689 | ووکامرس فارسی | 28 | 157 | 215 | 90k+ | Output is not escaped | ||
| #690 | PHP Browser Detection | 28 | 68 | 49 | 600 | Non-prefixed function | ||
| #691 | Autopay | 28 | 769 | 334 | 3k+ | Text Domain Mismatch | ||
| #692 | Product Sync for WooCommerce | 28 | 158 | 375 | 400 | Direct Query | ||
| #693 | PushAlert – Web Push Notifications for WordPress and WooCommerce | 28 | 196 | 63 | 1k+ | curl curl setopt | ||
| #694 | Redis Object Cache | 28 | 151 | 103 | 400k+ | Exception output is not escaped | ||
| #695 | Responsive Lightbox & Gallery | 28 | 139 | 513 | 100k+ | Non-prefixed hook name | ||
| #696 | Secure Downloads | 28 | 616 | 406 | 600 | Output is not escaped | ||
| #697 | Praison AI SEO | 28 | 649 | 306 | 1k+ | Text Domain Mismatch | ||
| #698 | Transliterator – Multilingual and Multi-script Text Conversion | 28 | 305 | 322 | 3k+ | Output is not escaped | ||
| #699 | Sparkle Demo Importer | 28 | 307 | 166 | 5k+ | Text Domain Mismatch | ||
| #700 | Temporary Login Without Password | 28 | 128 | 131 | 100k+ | wp function not compatible with requires wp |
