PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_fread

file system operations fread

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1Themify Builder95,3342,1715k+Text Domain Mismatch
#2JetBackup – Backup, Restore & Migrate101,567156200k+Exception output is not escaped
#3404 Solution155821,53210k+Non-prefixed class
#4AnyComment174454495k+Output is not escaped
#5RestroPress – Online Food Ordering System175353,2341k+Non-prefixed global variable
#6wpForo Forum174,3063,02620k+Unsafe printing function
#7WPtouch – Make your WordPress Website Mobile-Friendly171,46632550k+Text Domain Mismatch
#8Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution181,229923100k+Exception output is not escaped
#9Shopping Cart & eCommerce Store188,24018,4783k+Non-prefixed global variable
#10Matomo Analytics – Powerful, Privacy-First Insights for WordPress191,993892100k+Exception output is not escaped
#11Razorpay Payment Button Plugin19486982k+Exception output is not escaped
#12WP Email Template193443452k+Exception output is not escaped
#13WPOSS阿里云对象存储19269315900Non-prefixed namespace
#14WPQiNiu七牛云对象存储19138612400Non-prefixed global variable
#15Download Monitor204231,36780k+Non-prefixed hook name
#16Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More202,8741,9881m+Non-prefixed global variable
#17EventPrime – Events Calendar, Bookings, Tickets & AI208464,2247k+Non-prefixed global variable
#18Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non-prefixed global variable
#19پلاگین پرداخت دلخواه20584446900Text Domain Mismatch
#20Pix por Piggly (para Woocommerce)205471954k+Exception output is not escaped
#21Razorpay Payment Button Elementor Plugin20479621k+Exception output is not escaped
#22Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF20556543100k+Output is not escaped
#23Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools207873,41630k+Non-prefixed global variable
#24WP Compress – Instant Performance & Speed Optimization204,2923,69110k+Non Singular String Literal Domain
#25WP Minify Fix20306380800Output is not escaped
#26Backup Migration219991,08180k+Non-prefixed global variable
#27Kadence Security – Password, Two Factor Authentication, and Brute Force Protection211,060959700k+Missing Translators Comment
#28Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots211,6732,18010k+Direct Query
#29Captcha Them All213003235k+Output is not escaped
#30Comet Cache2185724520k+Output is not escaped
#31DELUCKS SEO213621,171300Missing nonce verification
#32Event Espresso – Event Registration & Ticketing Sales2112,7102,136600Text Domain Mismatch
#33FileOrganizer – WordPress File Manager21549261200k+unlink unlink
#34Modular DS: Monitor, update, and backup multiple websites211998240k+Exception output is not escaped
#35Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4363,34510k+Non-prefixed global variable
#36Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages211,1202,9138k+Non-prefixed global variable
#37Razorpay for Gravity Forms2141147500Exception output is not escaped
#38Razorpay Quick Payments21399632k+Exception output is not escaped
#39Five Star Restaurant Reservations – WordPress Booking Plugin211,1011,15910k+Output is not escaped
#40Rocket Maintenance Mode & Coming Soon Page211,1761,4064k+Non-prefixed global variable
#41SeatReg213501,842300Missing nonce verification
#42Simple Job Board216351,37610k+Non-prefixed global variable
#43TotalPoll for Polls and Contests211,3661551k+Text Domain Mismatch
#44Revive Social – Social Media Auto Post and Scheduling Automation Plugin2125443520k+Non-prefixed hook name
#45UPC/EAN/GTIN Barcode Generator/Importer21776311500Exception output is not escaped
#46Buckaroo Payments for WooCommerce216923512k+Exception output is not escaped
#47WebP Express21160427300k+Non-prefixed global variable
#48Razorpay for WooCommerce21980864100k+Non-prefixed function
#49PPOM – Product Addons & Custom Fields for WooCommerce213341,31720k+Non-prefixed global variable
#50Wordfence Security – Firewall, Malware Scan, and Login Security211,8933,2925m+Output is not escaped