PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_fclose

file system operations fclose

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#151LearnPress – WordPress LMS Plugin for Create and Sell Online Courses222,3463,34170k+Non-prefixed global variable
#152Mail Baby SMTP22385699600SQL query is not prepared
#153MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.222,6192,45310k+Output is not escaped
#154MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution221,1311,844800Non-prefixed global variable
#155Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider22207323500k+Non-prefixed global variable
#156Moloni229023562k+Missing Arg Domain
#157Motors – Car Dealership & Classified Listings Plugin225,3405,9589k+Text Domain Mismatch
#158myCred Toolkit with AI Assistant – Scale Your Loyalty & Gamification Rewards With Integrations221,5881,172400Output is not escaped
#159Newsletters222,9682,2482k+Text Domain Mismatch
#160NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall221,2662,059100k+Non-prefixed global variable
#161NinjaScanner – Virus & Malware scan2259655130k+Non-prefixed global variable
#162oik224891802k+Non Singular String Literal Domain
#163PDF Builder for WPForms22321266900SQL query is not prepared
#164Smart Popup by Supsystic223,17250310k+Non Singular String Literal Domain
#165Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App221,5812,326300k+Non-prefixed global variable
#166Prime Mover – Migrate WordPress Website & Backups221,3261,60010k+Non-prefixed global variable
#167Product Catalog Feed by PixelYourSite225813578k+Output is not escaped
#168PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP229844075k+Unsafe printing function
#169Quick Contact Form222606231k+Non-prefixed function
#170RealPress – Real Estate Plugin226041,167500Non-prefixed global variable
#171Request a Quote Form Plugin – Price Quote Request Management Made Easy222411,1091k+Non-prefixed hook name
#172SALESmanago & Leadoo226454291k+Unsafe printing function
#173Social Sharing Plugin – Sassy Social Share221,689233100k+wp function not compatible with requires wp
#174Seraphinite Accelerator2259425550k+Output is not escaped
#175ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF221,044799300k+Non-prefixed global variable
#176Simple Job Board226341,35510k+Non-prefixed global variable
#177Slim Jetpack222,5861,9472k+Text Domain Mismatch
#178SNS Count Cache229181208k+Non Singular String Literal Domain
#179SportsPress – Sports Club & League Manager224602,24210k+Non-prefixed global variable
#180SSL Zen — SSL Certificate Installer & HTTPS Redirects227791,57510k+Non-prefixed global variable
#181Stylish Price List – Price Table Builder & QR Code Restaurant Menu226746783k+Output is not escaped
#182Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent222255198k+error log error log
#183The Moneytizer227512711k+Text Domain Mismatch
#184Theme Editor2279868550k+Output is not escaped
#185Customize Feeds for Twitter22921714k+Non-prefixed global variable
#186RapidLoad AI – Optimize Web Vitals Automatically2281840800Nonce verification recommended
#187Search & Replace Everything – Quick and Easy Way to Find and Replace Text, Links221,0441,79720k+Non-prefixed global variable
#188UpStream: a Project Management Plugin for WordPress22683703600Non-prefixed global variable
#189URL Shortify – Simple and Easy URL Shortener221,5202,68910k+Non-prefixed global variable
#190Welcart e-Commerce2210,37710,89610k+Text Domain Mismatch
#191UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds22444243200k+Text Domain Mismatch
#192WCFM – Frontend Manager for WooCommerce224,7545,05420k+Non-prefixed global variable
#193WCFM Marketplace – Multivendor Marketplace for WooCommerce221,9341,96610k+Non-prefixed global variable
#194WCFM Membership – WooCommerce Memberships for Multivendor Marketplace2255967510k+Non-prefixed global variable
#195Wenprise WeChatPay Payment Gateway For WooCommerce22443178400Exception output is not escaped
#196WooCommerce221,3596,1717m+Non-prefixed global variable
#197Simple Shopping Cart2279653610k+Unsafe printing function
#198ManageWP Worker225075651m+Non-prefixed class
#199WP Express Checkout (Fast Payments via PayPal & Stripe)225916271k+Output is not escaped
#200File Manager227405201m+Unsafe printing function