PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_fputs

file system operations fputs

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1RestroPress – Online Food Ordering System185213,0831k+Non-prefixed global variable
#2Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution191,218901100k+Exception output is not escaped
#3پلاگین پرداخت دلخواه20584446900Text Domain Mismatch
#4WPJAM Basic203283564k+Output is not escaped
#5Backup Migration219811,09380k+Non-prefixed global variable
#6Captcha Them All213003236k+Output is not escaped
#7DELUCKS SEO213621,171400Missing nonce verification
#8Ebook Store216661,087700Non-prefixed global variable
#9EventPrime – Events Calendar, Bookings and Tickets218724,2977k+Non-prefixed global variable
#10FACTO – Facturación Electrónica21220245400Request data is not unslashed
#11FileOrganizer – WordPress File Manager21536241200k+unlink unlink
#12Mergado Pack212,323588700Output is not escaped
#13Mooberry Book Manager211,0403991k+Text Domain Mismatch
#14Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4693,33310k+Non-prefixed global variable
#15Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction211,9185,06510k+Non-prefixed hook name
#16Smart Forms – when you need more than just a contact form217765745k+Output is not escaped
#17UPC/EAN/GTIN Barcode Generator/Importer21776311500Exception output is not escaped
#18All-in-One Video Gallery229112,89220k+Non-prefixed global variable
#19Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8581,27050k+Text Domain Mismatch
#20RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login223,6545,0618k+Non-prefixed global variable
#21File Manager Pro – Filester22565391100k+Request data is not unslashed
#22FireBox Popups – Increase Sales and Grow Your Email List221538127k+Non-prefixed global variable
#23Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder22409236700k+Text Domain Mismatch
#24InfiniteWP Client222,2861,812200k+Exception output is not escaped
#25Import WP – Export and Import CSV and XML files to WordPress225803304k+Exception output is not escaped
#26Newsletters222,9682,2482k+Text Domain Mismatch
#27Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App221,5812,326300k+Non-prefixed global variable
#28NextScripts: Social Networks Auto-Poster222,4081,13330k+Output is not escaped
#29ManageWP Worker225075651m+Non-prefixed class
#30File Manager227405201m+Unsafe printing function
#31YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports2265443510k+Exception output is not escaped
#32Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe239,31026,6421k+Non-prefixed global variable
#33FV Flowplayer Video Player231,3111,45420k+Output is not escaped
#34Groundhogg — CRM, Newsletters, and Marketing Automation231369112k+Non-prefixed global variable
#35Restaurant Menu and Food Ordering233858532k+Non-prefixed global variable
#36MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO234885802k+Missing nonce verification
#37MyWorks Sync for WooCommerce & QuickBooks Online232,2929,1015k+Non-prefixed global variable
#38RSVP and Event Management233466223k+Direct Query
#39Local Google Analytics for WordPress – caches external requests235511993k+Output is not escaped
#40Softaculous231164910k+file system operations fread
#41Lead Form Data Collection to CRM232111,698400Non-prefixed global variable
#42پارسی دیت – Parsi Date23102289100k+Non-prefixed hook name
#43WP STAGING – WordPress Backup, Migration, Clone & Duplicate231,4891,549100k+Non-prefixed global variable
#44WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel231,1193,51620k+Interpolated SQL is not prepared
#45Zephyr Project Manager236672,4541k+Non-prefixed global variable
#46A2 Optimized WP – Turbocharge and secure your WordPress site2427123160k+Missing Arg Domain
#47Backuply – Backup, Restore, Migrate and Clone24704551700k+Non-prefixed global variable
#48WOLF – WordPress Posts Bulk Editor and Manager Professional244856234k+Output is not escaped
#49RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress248283,665500Request data is not unslashed
#50Custom CSS247036571k+Output is not escaped