PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_fputs

file system operations fputs

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1RestroPress – Online Food Ordering System175363,2361k+Non-prefixed global variable
#2Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution181,229923100k+Exception output is not escaped
#3EventPrime – Events Calendar, Bookings, Tickets & AI208464,2247k+Non-prefixed global variable
#4پلاگین پرداخت دلخواه20584446900Text Domain Mismatch
#5Backup Migration219991,08180k+Non-prefixed global variable
#6Captcha Them All213003235k+Output is not escaped
#7DELUCKS SEO213621,171300Missing nonce verification
#8FileOrganizer – WordPress File Manager21549261200k+unlink unlink
#9Mergado Pack212,323588700Output is not escaped
#10Mooberry Book Manager211,0403991k+Text Domain Mismatch
#11Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4363,34510k+Non-prefixed global variable
#12Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction211,9945,33110k+Non-prefixed hook name
#13Smart Forms – when you need more than just a contact form217765745k+Output is not escaped
#14UPC/EAN/GTIN Barcode Generator/Importer21776311500Exception output is not escaped
#15All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos229112,89720k+Non-prefixed global variable
#16Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8541,26940k+Text Domain Mismatch
#17RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login223,6555,1587k+Non-prefixed global variable
#18Ebook Store224061,076700Non-prefixed global variable
#19FACTO – Facturación Electrónica22258450300Request data is not unslashed
#20File Manager Pro – Filester22584411100k+Request data is not unslashed
#21FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment221538477k+Non-prefixed global variable
#22Groundhogg — CRM, Newsletters, and Marketing Automation221029012k+Non-prefixed global variable
#23Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar221,0852,7777k+Non-prefixed global variable
#24Newsletters222,9862,2542k+Text Domain Mismatch
#25Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin229362,941200k+Non-prefixed global variable
#26File Manager227755661m+Unsafe printing function
#27WPJAM Basic222783434k+Output is not escaped
#28YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports221,36647710k+Offloaded Content
#29RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress239073,808400Request data is not unslashed
#30Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe239,58427,7311k+Non-prefixed global variable
#31FV Flowplayer Video Player231,2801,45610k+Output is not escaped
#32InfiniteWP Client232,3791,844200k+Exception output is not escaped
#33Import WP – CSV & XML Import Export for WordPress235883294k+Exception output is not escaped
#34MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO234876062k+Missing nonce verification
#35MyWorks Sync for WooCommerce & QuickBooks Online232,2929,1015k+Non-prefixed global variable
#36Local Google Analytics for WordPress – caches external requests235511993k+Output is not escaped
#37European VAT Compliance Assistant for WooCommerce235183173k+Output is not escaped
#38ManageWP Worker235015701m+Non-prefixed class
#39Lead Form Data Collection to CRM232111,698400Non-prefixed global variable
#40WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups231,6421,839100k+Non-prefixed global variable
#41A2 Optimized WP – Turbocharge and secure your WordPress site2427123160k+Missing Arg Domain
#42Backuply – Backup, Restore, Migrate and Clone24729553600k+Non-prefixed global variable
#43Custom CSS24703657900Output is not escaped
#44Etsy Integration For WooCommerce241,2464,643900Non-prefixed global variable
#45FV Simpler SEO247663082k+Text Domain Mismatch
#46FV Player 8243301,3721k+Non-prefixed function
#47GD Mail Queue24502582700Output is not escaped
#48GG Woo Feed for WooCommerce Shopping Feed on Google and Other Channels244695921k+Non-prefixed global variable
#49Restaurant Menu and Food Ordering243838302k+Non-prefixed global variable
#50MxChat – AI Chatbot & Content Generation for WordPress243,7541,8982k+Text Domain Mismatch