WordPress.WP.AlternativeFunctions.file_system_operations_fputs
file system operations fputs
The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.
Why It Shows Up
Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.
Why It Matters
WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.
How to Fix
- Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
- Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
- Never write PHP code from user input or remote responses.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #51 | FV Simpler SEO | 24 | 766 | 308 | 2k+ | Text Domain Mismatch | ||
| #52 | FV Player 8 | 24 | 323 | 1,383 | 1k+ | Non-prefixed function | ||
| #53 | GD Mail Queue | 24 | 502 | 582 | 700 | Output is not escaped | ||
| #54 | GG Woo Feed for WooCommerce Shopping Feed on Google and Other Channels | 24 | 469 | 592 | 1k+ | Non-prefixed global variable | ||
| #55 | Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar | 24 | 977 | 2,178 | 7k+ | Non-prefixed global variable | ||
| #56 | MxChat – AI Chatbot & Content Generation for WordPress | 24 | 3,459 | 1,546 | 2k+ | Text Domain Mismatch | ||
| #57 | ProfileGrid – User Profiles, Groups and Communities | 24 | 483 | 2,463 | 5k+ | Non-prefixed global variable | ||
| #58 | RSVP and Event Management | 24 | 345 | 624 | 3k+ | Direct Query | ||
| #59 | SiteGuard WP Plugin | 24 | 359 | 352 | 600k+ | Output is not escaped | ||
| #60 | Softaculous | 24 | 115 | 50 | 10k+ | file system operations fread | ||
| #61 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin | 24 | 938 | 2,935 | 200k+ | Non-prefixed global variable | ||
| #62 | Video Conferencing with Zoom | 24 | 1,105 | 440 | 10k+ | Unsafe printing function | ||
| #63 | European VAT Compliance Assistant for WooCommerce | 24 | 515 | 317 | 3k+ | Output is not escaped | ||
| #64 | WP-Members Membership Plugin | 24 | 669 | 382 | 50k+ | Output is not escaped | ||
| #65 | پارسی دیت – Parsi Date | 24 | 110 | 293 | 100k+ | Non-prefixed hook name | ||
| #66 | WP Travel – Ultimate Travel Booking System, Tour Management Engine | 24 | 227 | 1,941 | 4k+ | Non-prefixed hook name | ||
| #67 | WP Travel Engine – Tour Booking Plugin – Tour Operator Software | 24 | 2,030 | 5,704 | 20k+ | Non-prefixed global variable | ||
| #68 | GD Rating System | 25 | 1,511 | 1,043 | 1k+ | Output is not escaped | ||
| #69 | GD Security Headers | 25 | 407 | 521 | 1k+ | Output is not escaped | ||
| #70 | Site Kit by Google – Analytics, Search Console, AdSense, Speed | 25 | 1,318 | 242 | 5m+ | Missing direct file access protection | ||
| #71 | Pz-LinkCard | 25 | 949 | 1,614 | 20k+ | Non-prefixed global variable | ||
| #72 | Secure Copy Content Protection and Content Locking | 25 | 646 | 804 | 20k+ | Output is not escaped | ||
| #73 | VikAppointments Services Booking Calendar | 25 | 9,759 | 5,209 | 500 | Output is not escaped | ||
| #74 | VikBooking Hotel Booking Engine & PMS | 25 | 13,251 | 8,316 | 8k+ | Output is not escaped | ||
| #75 | VikRentCar Car Rental Management System | 25 | 5,537 | 5,048 | 4k+ | Non-prefixed global variable | ||
| #76 | VikRestaurants Table Reservations and Take-Away | 25 | 11,644 | 4,932 | 600 | Output is not escaped | ||
| #77 | WPvivid Backup for MainWP | 25 | 852 | 1,798 | 10k+ | Missing nonce verification | ||
| #78 | WPvivid — Backup, Migration & Staging | 25 | 903 | 1,461 | 900k+ | Non-prefixed namespace | ||
| #79 | CheckView – Form & Checkout Testing | 26 | 69 | 332 | 1k+ | Direct Query | ||
| #80 | FG Drupal to WordPress | 26 | 275 | 100 | 700 | Unsafe printing function | ||
| #81 | FG PrestaShop to WooCommerce | 26 | 254 | 94 | 900 | Unsafe printing function | ||
| #82 | FV Antispam | 26 | 332 | 239 | 900 | Output is not escaped | ||
| #83 | FG Joomla to WordPress | 27 | 278 | 101 | 7k+ | Unsafe printing function | ||
| #84 | درگاه پرداخت بانک ملت ووکامرس | 28 | 61 | 130 | 2k+ | Request data is not unslashed | ||
| #85 | User Verification by PickPlugins | 29 | 41 | 314 | 5k+ | Request data is not unslashed | ||
| #86 | Export Plugins and Templates | 30 | 143 | 33 | 1k+ | file system operations fread | ||
| #87 | FormLift for Keap (Legacy) Web Forms | 30 | 162 | 315 | 400 | Request data is not unslashed | ||
| #88 | České služby pro WordPress | 31 | 95 | 139 | 1k+ | Output is not escaped | ||
| #89 | Einsatzverwaltung | 34 | 152 | 128 | 1k+ | Output is not escaped | ||
| #90 | HollerBox — Fast & Effective Popups & Lead-Generation | 35 | 77 | 92 | 2k+ | Output is not escaped | ||
| #91 | Security Optimizer – The All-In-One Protection Plugin | 35 | 40 | 86 | 1m+ | Input is not sanitized | ||
| #92 | Custom Database Applications by Caspio | 36 | 32 | 63 | 400 | Input is not sanitized | ||
| #93 | Export Themes | 36 | 122 | 90 | 2k+ | Non-prefixed constant | ||
| #94 | Send PDF for Contact Form 7 | 37 | 22 | 308 | 9k+ | Non-prefixed global variable | ||
| #95 | Tilopay | 37 | 35 | 130 | 1k+ | Nonce verification recommended | ||
| #96 | Blackhole for Bad Bots | 39 | 123 | 69 | 30k+ | Output is not escaped | ||
| #97 | Database Addon for Contact Form 7 – CFDB7 | 39 | 35 | 57 | 600k+ | Nonce verification recommended | ||
| #98 | Video Gallery – YouTube, Vimeo Gallery & YouTube API | 40 | 53 | 69 | 1k+ | Request data is not unslashed | ||
| #99 | Powie's WHOIS Domain Check | 41 | 38 | 11 | 500 | Unsafe printing function | ||
| #100 | Tabby Checkout | 47 | 33 | 46 | 4k+ | Non-prefixed class |
