PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_fputs

file system operations fputs

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1RestroPress – Online Food Ordering System175243,1551k+Non-prefixed global variable
#2Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution191,218901100k+Exception output is not escaped
#3WPJAM Basic193253464k+Output is not escaped
#4پلاگین پرداخت دلخواه20584446900Text Domain Mismatch
#5Backup Migration219811,09380k+Non-prefixed global variable
#6Captcha Them All213003235k+Output is not escaped
#7DELUCKS SEO213621,171400Missing nonce verification
#8EventPrime – Events Calendar, Bookings and Tickets218734,3087k+Non-prefixed global variable
#9FileOrganizer – WordPress File Manager21536241200k+unlink unlink
#10Mergado Pack212,323588700Output is not escaped
#11Mooberry Book Manager211,0403991k+Text Domain Mismatch
#12Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4813,34410k+Non-prefixed global variable
#13Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction211,9535,29710k+Non-prefixed hook name
#14Smart Forms – when you need more than just a contact form217765745k+Output is not escaped
#15UPC/EAN/GTIN Barcode Generator/Importer21776311500Exception output is not escaped
#16All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos229122,88520k+Non-prefixed global variable
#17Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8541,26950k+Text Domain Mismatch
#18RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login223,6525,1348k+Non-prefixed global variable
#19Ebook Store224101,054700Non-prefixed global variable
#20FACTO – Facturación Electrónica22244423400Request data is not unslashed
#21File Manager Pro – Filester22566391100k+Request data is not unslashed
#22FireBox Popups – Increase Sales and Grow Your Email List221578267k+Non-prefixed global variable
#23Newsletters222,9772,2612k+Text Domain Mismatch
#24Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App221,5812,326300k+Non-prefixed global variable
#25NextScripts: Social Networks Auto-Poster222,4081,13320k+Output is not escaped
#26File Manager227405201m+Unsafe printing function
#27YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports2265443510k+Exception output is not escaped
#28WPBot – AI ChatBot for Live Support, Lead Generation, AI Services235181,2195k+Non-prefixed global variable
#29Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe239,39626,6801k+Non-prefixed global variable
#30Events Made Easy235266,3581k+Non-prefixed function
#31Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder23407236700k+Text Domain Mismatch
#32FV Flowplayer Video Player231,3111,45410k+Output is not escaped
#33Groundhogg — CRM, Newsletters, and Marketing Automation231369192k+Non-prefixed global variable
#34InfiniteWP Client232,2871,811200k+Exception output is not escaped
#35Import WP – Export and Import CSV and XML files to WordPress235793244k+Exception output is not escaped
#36Restaurant Menu and Food Ordering233858532k+Non-prefixed global variable
#37MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO234855802k+Missing nonce verification
#38MyWorks Sync for WooCommerce & QuickBooks Online232,2929,1015k+Non-prefixed global variable
#39Security Plugin, Firewall & Malware Scanner with Auto Removal231,20478940k+Output is not escaped
#40Local Google Analytics for WordPress – caches external requests235511993k+Output is not escaped
#41ManageWP Worker235065651m+Non-prefixed class
#42Lead Form Data Collection to CRM232111,698400Non-prefixed global variable
#43WP STAGING – WordPress Backups, Restore, Migration & Clone231,5251,610100k+Non-prefixed global variable
#44WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel231,1583,64220k+Interpolated SQL is not prepared
#45Zephyr Project Manager236672,4541k+Non-prefixed global variable
#46A2 Optimized WP – Turbocharge and secure your WordPress site2427123160k+Missing Arg Domain
#47Backuply – Backup, Restore, Migrate and Clone24711556600k+Non-prefixed global variable
#48RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress248423,717500Request data is not unslashed
#49Custom CSS247036571k+Output is not escaped
#50Etsy Integration For WooCommerce241,2464,643900Non-prefixed global variable