WordPress.WP.AlternativeFunctions.file_system_operations_fclose
file system operations fclose
The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.
Why It Shows Up
Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.
Why It Matters
WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.
How to Fix
- Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
- Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
- Never write PHP code from user input or remote responses.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #951 | QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly | 35 | 225 | 110 | 8k+ | Non Singular String Literal Domain | ||
| #952 | Security Optimizer – The All-In-One Protection Plugin | 35 | 40 | 86 | 1m+ | Input is not sanitized | ||
| #953 | Simple History – Track, Log, and Audit WordPress Changes | 35 | 32 | 122 | 300k+ | Non-prefixed global variable | ||
| #954 | Solid Performance – Your No-Code Caching, Performance, & Page Speed Solution | 35 | 75 | 61 | 4k+ | Exception output is not escaped | ||
| #955 | String locator | 35 | 52 | 319 | 100k+ | Non-prefixed global variable | ||
| #956 | Taxonomy CSV Import Export | 35 | 5 | 30 | 700 | Missing nonce verification | ||
| #957 | The Courier Guy Shipping for WooCommerce | 35 | 57 | 107 | 3k+ | Missing nonce verification | ||
| #958 | Vendi Abandoned Plugin Check | 35 | 13 | 3 | 1k+ | trademarked term | ||
| #959 | Video Grid | 35 | 253 | 106 | 1k+ | Output is not escaped | ||
| #960 | Video Gallery | 35 | 336 | 178 | 600 | Output is not escaped | ||
| #961 | ShipStation Live Rates for WooCommerce | 35 | 402 | 73 | 900 | Non Singular String Literal Domain | ||
| #962 | Converter for Media – Optimize images | Convert WebP & AVIF | 35 | 133 | 53 | 500k+ | curl curl setopt | ||
| #963 | Easy Accept Payments via PayPal | 35 | 322 | 128 | 7k+ | Text Domain Mismatch | ||
| #964 | WP Compiler | 35 | 33 | 20 | 1k+ | Output is not escaped | ||
| #965 | Database Backup for WordPress | 35 | 128 | 88 | 70k+ | Output is not escaped | ||
| #966 | Mail logging – WP Mail Catcher | 35 | 232 | 157 | 20k+ | Text Domain Mismatch | ||
| #967 | WP-Paginate | 35 | 37 | 55 | 20k+ | Input is not validated | ||
| #968 | WP PGP Encrypted Emails | 35 | 63 | 39 | 400 | Output is not escaped | ||
| #969 | video carousel slider with lightbox | 35 | 350 | 136 | 1k+ | Output is not escaped | ||
| #970 | Integration for WooCommerce and QuickBooks | 35 | 263 | 125 | 1k+ | Output is not escaped | ||
| #971 | WSB HUB3 | 35 | 36 | 109 | 1k+ | Missing nonce verification | ||
| #972 | XServer Migrator | 35 | 39 | 53 | 10k+ | Interpolated SQL is not prepared | ||
| #973 | Yabe Webfont – Use Custom Fonts, Google Fonts or Adobe Fonts | 35 | 48 | 114 | 5k+ | Non-prefixed hook name | ||
| #974 | Year Make Model Search for WooCommerce | 35 | 188 | 162 | 1k+ | Output is not escaped | ||
| #975 | Bard Extra | 36 | 159 | 75 | 700 | Text Domain Mismatch | ||
| #976 | Blaze Demo Importer | 36 | 101 | 94 | 8k+ | Output is not escaped | ||
| #977 | bpost shipping | 36 | 97 | 43 | 700 | Output is not escaped | ||
| #978 | Cashflows for WooCommerce | 36 | 118 | 36 | 600 | Text Domain Mismatch | ||
| #979 | Simple SEO | 36 | 164 | 113 | 10k+ | Non Singular String Literal Domain | ||
| #980 | CLP – Custom Login Page by NiteoThemes | 36 | 240 | 49 | 700 | Output is not escaped | ||
| #981 | ColorMeShop WordPress Plugin | 36 | 392 | 37 | 600 | Exception output is not escaped | ||
| #982 | Custom Database Applications by Caspio | 36 | 32 | 63 | 400 | Input is not sanitized | ||
| #983 | Custom PHP Settings | 36 | 153 | 76 | 10k+ | Output is not escaped | ||
| #984 | Dashboard Widgets Suite | 36 | 206 | 124 | 4k+ | Output is not escaped | ||
| #985 | Database Collation Fix | 36 | 50 | 32 | 1k+ | Output is not escaped | ||
| #986 | Depicter — Popup & Slider Builder | 36 | 130 | 121 | 80k+ | Exception output is not escaped | ||
| #987 | Drag and Drop Multiple File Upload for Contact Form 7 | 36 | 82 | 36 | 60k+ | wp function not compatible with requires wp | ||
| #988 | Export Variable Products | 36 | 79 | 49 | 400 | Text Domain Mismatch | ||
| #989 | HTML5 Maps | 36 | 194 | 160 | 5k+ | Output is not escaped | ||
| #990 | If-So Geolocation | 36 | 50 | 57 | 1k+ | Non-prefixed global variable | ||
| #991 | Just TinyMCE Custom Styles | 36 | 112 | 28 | 1k+ | Missing Arg Domain | ||
| #992 | Leartes TRY Exchange Rates | 36 | 250 | 27 | 500 | Text Domain Mismatch | ||
| #993 | We’re Open! | 36 | 273 | 187 | 5k+ | Unsafe printing function | ||
| #994 | Order Status History for WooCommerce | 36 | 210 | 171 | 1k+ | Output is not escaped | ||
| #995 | PDF Forms Filler for CF7 | 36 | 185 | 79 | 3k+ | Text Domain Mismatch | ||
| #996 | PDF Forms Filler for WPForms | 36 | 161 | 54 | 600 | Text Domain Mismatch | ||
| #997 | Plugins Garbage Collector (Database Cleanup) | 36 | 32 | 51 | 10k+ | Missing nonce verification | ||
| #998 | Qubely – Advanced Gutenberg Blocks | 36 | 39 | 78 | 8k+ | Request data is not unslashed | ||
| #999 | Quick 301 Redirects | 36 | 89 | 120 | 5k+ | Non-prefixed global variable | ||
| #1000 | Search & Replace | 36 | 50 | 53 | 100k+ | Missing nonce verification |
