PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_fopen

file system operations fopen

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#351Digital License Manager24295670700Non-prefixed hook name
#352Doubly – Cross Domain Copy Paste for WordPress242525510k+Output is not escaped
#353DSGVO All in one for WP24751,63720k+Non-prefixed global variable
#354eCommerce Product Catalog Plugin for WordPress246213,1777k+Non-prefixed function
#355Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress246521,49560k+Non-prefixed hook name
#356Enable Media Replace24212276600k+Output is not escaped
#357Event Tickets and Registration243,4114,21790k+Non-prefixed global variable
#358Export WordPress Pages to Static HTML & PDF — Static Site Export245093044k+Text Domain Mismatch
#359Etsy Integration For WooCommerce241,2464,643900Non-prefixed global variable
#360F12 Profiler24282451500Direct Query
#361Fast Velocity Minify2428225640k+Unsafe printing function
#362Fattura2424312333400Output is not escaped
#363Featured Image from URL (FIFU)241,65441870k+Non Singular String Literal Domain
#364Featured Post with thumbnail24158122400Output is not escaped
#365FileBird – WordPress Media Library Folders & File Manager24239377200k+wp function not compatible with requires wp
#366Fix Alt Text245443461k+Non Singular String Literal Domain
#367Football Pool241,0857331k+Output is not escaped
#368Formidable PRO2PDF242184771k+Non-prefixed global variable
#369FV Player 8243231,3831k+Non-prefixed function
#370Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress2453632410k+Text Domain Mismatch
#371GD Mail Queue24502582700Output is not escaped
#372GG Woo Feed for WooCommerce Shopping Feed on Google and Other Channels244695921k+Non-prefixed global variable
#373Assets manager, dequeue scripts, dequeue styles for WordPress245922552k+Output is not escaped
#374Simple Calendar – Google Calendar Plugin242,05359250k+Missing direct file access protection
#375Easy Google Maps241,76438920k+Non Singular String Literal Domain
#376Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN243,41086670k+Text Domain Mismatch
#377Import and export users and customers241,04035770k+Unsafe printing function
#378Infinite Uploads – Offload Media and Video to Cloud Storage24586722800Direct Query
#379Keap Official Opt-in Forms248291,0461k+Non-prefixed global variable
#380Social Slider Feed – Social Media Feed & Gallery Widgets2492970720k+Non-prefixed global variable
#381InstaWP Connect – 1-click WP Staging & Migration2425381140k+Non-prefixed global variable
#382Dynamics 365 Integration24383166600Output is not escaped
#383Koko Analytics – Privacy-Friendly WordPress Analytics2416539360k+Short PHP open tag found
#384LatePoint – Calendar Booking Plugin for Appointments and Events241,847937100k+Output is not escaped
#385LearnPress – Backup & Migration Tool243854695k+Output is not escaped
#386LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes244141,17610k+Non-prefixed global variable
#387Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails244,6961,4805k+Text Domain Mismatch
#388MailerPress – Newsletter, email marketing & AI automation248053,9311k+Direct Query
#389Mang Board WP241,2134,7209k+Non-prefixed global variable
#390Media Library Folders2488980710k+Text Domain Mismatch
#391Timetable and Event Schedule by MotoPress2445623230k+Output is not escaped
#392NEX-Forms – Ultimate Forms Plugin for WordPress242,0081,1956k+Text Domain Mismatch
#393Ninja Forms – The Contact Form Builder That Grows With You247491,525600k+Nonce verification recommended
#394Omnipress24169245800Non-prefixed global variable
#395Opt-Out for Google Analytics (DSGVO / GDPR)242901,9783k+Non-prefixed global variable
#396Participants Database249518947k+SQL query is not prepared
#397PDF Generator for WordPress Elementor245132711k+Exception output is not escaped
#398PeproDev Ultimate Invoice243792344k+Output is not escaped
#399Database Manager – WP Adminer241,0052,75220k+Non-prefixed global variable
#400Post Export Import with Media246191,3341k+Non-prefixed global variable