PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_fopen

file system operations fopen

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#501Perfect Brands for WooCommerce2811214340k+Non-prefixed constant
#502Responsive Lightbox & Gallery28139513100k+Non-prefixed hook name
#503Praison AI SEO286433061k+Text Domain Mismatch
#504Transliterator – Multilingual and Multi-script Text Conversion283053203k+Output is not escaped
#505Sparkle Demo Importer283071666k+Text Domain Mismatch
#506Temporary Login Without Password28128131100k+wp function not compatible with requires wp
#507Ultimate FAQ Accordion Plugin2838622730k+Unsafe printing function
#508Jetpack VaultPress287136210k+Missing nonce verification
#50910WebSocial2858418510k+Unsafe printing function
#510WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce281732265k+Output is not escaped
#511WPS Bidouille2847221510k+Output is not escaped
#512Alt Text AI – Automatically generate image alt text for SEO and accessibility297228020k+Non-prefixed global variable
#513aThemeArt Theme Helper292061512k+Non-prefixed global variable
#514Attribute Stock for WooCommerce – Shared Stock & Variable Quantities (Lite Version)294813132k+Text Domain Mismatch
#515Bitcoin Payments – Blockonomics292082273k+Output is not escaped
#516CloudSecure WP Security2974350100k+Request data is not unslashed
#517Database Cleaner2913529710k+Direct Query
#518DB Cache Reloaded Fix29133422k+Output is not escaped
#519Document Gallery29183988k+Output is not escaped
#520Interactive Image Map Plugin – Draw Attention2962022720k+Output is not escaped
#521FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider297478600k+Missing Translators Comment
#522Kits, Templates and Patterns29380915k+Text Domain Mismatch
#523Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization2980162200k+Nonce verification recommended
#524PhastPress29955210k+Exception output is not escaped
#525SQLite Database Integration29161893k+Exception output is not escaped
#526Visualizer – Tables & Charts Manager with Built-in AI Generator2934833120k+Output is not escaped
#527Widget for Yelp Reviews291471582k+Output is not escaped
#528Woostify Sites Library2922919820k+Text Domain Mismatch
#529WP-PostRatings2942538430k+Output is not escaped
#530XML for Google Merchant Center29523124k+Non-prefixed global variable
#531Advanced Database Cleaner – Optimize & Clean Database to Speed Up Site Performance30164439100k+Interpolated SQL is not prepared
#532ApplyOnline – Application Form Builder and Manager303542602k+Output is not escaped
#533Contact Form 7 Connector303241965k+Text Domain Mismatch
#534Element Invader – Template Kits for Elementor302741303k+Output is not escaped
#535Import WooCommerce Suite30804344k+Interpolated SQL is not prepared
#536Invisible reCaptcha for WordPress309018580k+Input is not sanitized
#537Jetpack Protect30657217100k+Text Domain Mismatch
#538Laposta Signup Embed3088191k+Exception output is not escaped
#539MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor3063227600k+Non-prefixed global variable
#540Popularis Extra302371417k+Output is not escaped
#541SmartCrawl SEO checker, analyzer & optimizer303471,30720k+Non-prefixed global variable
#542SMTP for Amazon SES – YaySMTP301971223k+Exception output is not escaped
#543Travelers' Map303111551k+Output is not escaped
#544Urvanov Syntax Highlighter30221873k+Output is not escaped
#545User Access Manager3039317110k+Output is not escaped
#546Widgetize Pages Light301451043k+Output is not escaped
#547WooCommerce Tax (formerly WooCommerce Shipping & Tax)30103198600k+Non-prefixed class
#548Yaad Sarig Payment Gateway For WC301582712k+Nonce verification recommended
#549AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization31911332k+Output is not escaped
#550Titan Anti-spam & Security – Brute Force Protection, 2FA & Spam Filter315719650k+Nonce verification recommended