PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_fclose

file system operations fclose

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#51Events Manager – OpenStreetMaps20559444700Output is not escaped
#52Razorpay for WooCommerce20975859100k+Non-prefixed function
#53WP Minify Fix20306380800Output is not escaped
#54Premium Packages – Sell Digital Products Securely202,0172,1832k+Non-prefixed global variable
#55Backup Migration219811,09380k+Non-prefixed global variable
#56Kadence Security – Password, Two Factor Authentication, and Brute Force Protection211,060957700k+Missing Translators Comment
#57Booking Ultra Pro Appointments Booking Calendar Plugin217612,083400Request data is not unslashed
#58Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots211,6212,03810k+Direct Query
#59rtMedia for WordPress, BuddyPress and bbPress213636477k+Non-prefixed constant
#60Captcha Them All213003235k+Output is not escaped
#61CartFlows – Funnel Builder & Checkout Plugin for WooCommerce21462656200k+Text Domain Mismatch
#62SMS Extension for Contact Form 7217201,387400Non-prefixed global variable
#63Comet Cache2185724520k+Output is not escaped
#64Daily Prayer Time219471,7801k+Non-prefixed global variable
#65DELUCKS SEO213621,171400Missing nonce verification
#66Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More212,5721,2771m+Output is not escaped
#67Envo Extra2187860020k+Text Domain Mismatch
#68EventPrime – Events Calendar, Bookings and Tickets218734,3087k+Non-prefixed global variable
#69Feeds for YouTube (YouTube video, channel, and gallery plugin)21558978100k+Output is not escaped
#70FileOrganizer – WordPress File Manager21536241200k+unlink unlink
#71Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More21522,063300k+Non-prefixed global variable
#72Campaign Monitor for WordPress213864612k+Non-prefixed global variable
#73Front End Users217192,759400Non-prefixed global variable
#74Mergado Pack212,323588700Output is not escaped
#75Modular DS: Monitor, update, and backup multiple websites211918240k+Exception output is not escaped
#76Mooberry Book Manager211,0403991k+Text Domain Mismatch
#77MotoPress Hotel Booking213,0671,03710k+Text Domain Mismatch
#78Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4783,33710k+Non-prefixed global variable
#79Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages211,1202,9139k+Non-prefixed global variable
#80Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction211,9535,29710k+Non-prefixed hook name
#81User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor217031,46340k+Missing Translators Comment
#82Razorpay for Gravity Forms2141147600Exception output is not escaped
#83Razorpay Quick Payments21399632k+Exception output is not escaped
#84Five Star Restaurant Reservations – WordPress Booking Plugin211,1011,15910k+Output is not escaped
#85Rocket Maintenance Mode & Coming Soon Page211,1761,4064k+Non-prefixed global variable
#86Royal Addons for Elementor – Addons and Templates Kit for Elementor2113,0162,440600k+Text Domain Mismatch
#87Seamless Donations is Sunset216005142k+Text Domain Mismatch
#88SeatReg213121,637400Missing nonce verification
#89Smart Forms – when you need more than just a contact form217765745k+Output is not escaped
#90Accept Stripe Payments2137389220k+Missing nonce verification
#91TotalPoll for Polls and Contests211,3661551k+Text Domain Mismatch
#92Trace My IP – Visitor IP Tracker, Stats Analytics & Page Views Counter with Email Alerts218713381k+wp function not compatible with requires wp
#93Revive Social – Social Media Auto Post and Scheduling Automation Plugin2125643120k+Non-prefixed hook name
#94Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin211,0742,97840k+Direct Query
#95UPC/EAN/GTIN Barcode Generator/Importer21776311500Exception output is not escaped
#96URL Shortify – Simple and Easy URL Shortener211,5112,66910k+Non-prefixed global variable
#97Buckaroo Woocommerce Payments Plugin216383212k+Exception output is not escaped
#98WebP Express21160427300k+Non-prefixed global variable
#99Wise Chat214705065k+Output is not escaped
#100Paysera Payment Gateway for WooCommerce211,8681967k+Exception output is not escaped