WordPress.WP.AlternativeFunctions.file_system_operations_fopen
file system operations fopen
The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.
Why It Shows Up
Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.
Why It Matters
WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.
How to Fix
- Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
- Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
- Never write PHP code from user input or remote responses.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #651 | Expand Divi | 28 | 91 | 100 | 1k+ | Non-prefixed global variable | ||
| #652 | FAPI Member | 28 | 279 | 153 | 500 | Exception output is not escaped | ||
| #653 | Fluent Support – Helpdesk & Customer Support Ticket System | 28 | 50 | 271 | 10k+ | Direct Query | ||
| #654 | Reviews and Rating – Google Reviews | 28 | 343 | 219 | 20k+ | Text Domain Mismatch | ||
| #655 | Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery | 28 | 384 | 175 | 10k+ | Text Domain Mismatch | ||
| #656 | GTmetrix for WordPress | 28 | 109 | 70 | 8k+ | Output is not escaped | ||
| #657 | Laposta Signup Basic | 28 | 276 | 67 | 2k+ | Output is not escaped | ||
| #658 | درگاه پرداخت بانک ملت ووکامرس | 28 | 61 | 130 | 2k+ | Request data is not unslashed | ||
| #659 | MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor | 28 | 62 | 248 | 600k+ | Non-prefixed global variable | ||
| #660 | My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu) | 28 | 164 | 441 | 100k+ | Non-prefixed global variable | ||
| #661 | Perfect Brands for WooCommerce | 28 | 112 | 143 | 40k+ | Non-prefixed constant | ||
| #662 | PHP Browser Detection | 28 | 68 | 49 | 600 | Non-prefixed function | ||
| #663 | Responsive Lightbox & Gallery | 28 | 139 | 513 | 100k+ | Non-prefixed hook name | ||
| #664 | Secure Downloads | 28 | 616 | 406 | 600 | Output is not escaped | ||
| #665 | Praison AI SEO | 28 | 649 | 306 | 1k+ | Text Domain Mismatch | ||
| #666 | Transliterator – Multilingual and Multi-script Text Conversion | 28 | 305 | 320 | 3k+ | Output is not escaped | ||
| #667 | Sparkle Demo Importer | 28 | 307 | 166 | 5k+ | Text Domain Mismatch | ||
| #668 | SureMembers – Membership & Content Restriction Plugin | 28 | 364 | 248 | 900 | Text Domain Mismatch | ||
| #669 | Temporary Login Without Password | 28 | 128 | 131 | 100k+ | wp function not compatible with requires wp | ||
| #670 | Ultimate FAQ Accordion Plugin | 28 | 386 | 227 | 30k+ | Unsafe printing function | ||
| #671 | Jetpack VaultPress | 28 | 71 | 362 | 10k+ | Missing nonce verification | ||
| #672 | VG WORT METIS | 28 | 150 | 317 | 900 | Nonce verification recommended | ||
| #673 | 10WebSocial | 28 | 584 | 185 | 10k+ | Unsafe printing function | ||
| #674 | WeeConnectPay – Clover Payment Gateway for WooCommerce | 28 | 179 | 171 | 500 | Exception output is not escaped | ||
| #675 | WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce | 28 | 177 | 226 | 5k+ | Output is not escaped | ||
| #676 | WPS Bidouille | 28 | 472 | 215 | 10k+ | Output is not escaped | ||
| #677 | WxSync-标准云微信公众号文章免费采集-任意公众号自动采集付费购买 | 28 | 57 | 138 | 500 | Request data is not unslashed | ||
| #678 | Accordion Slider Gallery | 29 | 379 | 142 | 1k+ | Text Domain Mismatch | ||
| #679 | Alt Text AI – Automatically generate image alt text for SEO and accessibility | 29 | 72 | 280 | 20k+ | Non-prefixed global variable | ||
| #680 | AppPresser – Mobile App Framework | 29 | 262 | 214 | 1k+ | Text Domain Mismatch | ||
| #681 | aThemeArt Theme Helper | 29 | 206 | 151 | 2k+ | Non-prefixed global variable | ||
| #682 | Attribute Stock for WooCommerce – Shared Stock & Variable Quantities (Lite Version) | 29 | 481 | 313 | 2k+ | Text Domain Mismatch | ||
| #683 | Bitcoin Payments – Blockonomics | 29 | 208 | 227 | 2k+ | Output is not escaped | ||
| #684 | CloudSecure WP Security | 29 | 74 | 350 | 100k+ | Request data is not unslashed | ||
| #685 | DB Cache Reloaded Fix | 29 | 133 | 42 | 2k+ | Output is not escaped | ||
| #686 | Di Themes Demo Site Importer | 29 | 343 | 183 | 1k+ | Text Domain Mismatch | ||
| #687 | Document Gallery | 29 | 183 | 98 | 8k+ | Output is not escaped | ||
| #688 | Interactive Image Map Plugin – Draw Attention | 29 | 620 | 227 | 20k+ | Output is not escaped | ||
| #689 | FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider | 29 | 74 | 78 | 600k+ | Missing Translators Comment | ||
| #690 | Easy HTTPS Redirection (SSL) | 29 | 266 | 152 | 100k+ | Unsafe printing function | ||
| #691 | Interactive World Map | 29 | 684 | 341 | 1k+ | Text Domain Mismatch | ||
| #692 | Kits, Templates and Patterns | 29 | 380 | 91 | 5k+ | Text Domain Mismatch | ||
| #693 | Laposta WooCommerce | 29 | 96 | 115 | 500 | Non-prefixed global variable | ||
| #694 | Meow Gallery | 29 | 113 | 182 | 10k+ | Direct Query | ||
| #695 | Offload Media – Cloud Storage | 29 | 126 | 80 | 1k+ | unlink unlink | ||
| #696 | Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization | 29 | 80 | 162 | 200k+ | Nonce verification recommended | ||
| #697 | pCloud WP Backup | 29 | 120 | 73 | 1k+ | Exception output is not escaped | ||
| #698 | PhastPress | 29 | 95 | 52 | 10k+ | Exception output is not escaped | ||
| #699 | PlatiOnline Payments | 29 | 304 | 110 | 700 | Output is not escaped | ||
| #700 | Pósturinn\'s Shipping with WooCommerce | 29 | 713 | 551 | 500 | Text Domain Mismatch |
