PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_fread

file system operations fread

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1Themify Builder95,3042,1365k+Text Domain Mismatch
#2JetBackup – Backup, Restore & Migrate101,563149200k+Exception output is not escaped
#3AnyComment174454495k+Output is not escaped
#4RestroPress – Online Food Ordering System175243,1551k+Non-prefixed global variable
#5wpForo Forum174,0482,92220k+Unsafe printing function
#6WPtouch – Make your WordPress Website Mobile-Friendly171,46632550k+Text Domain Mismatch
#7Podlove Podcast Publisher182,3541,4333k+Output is not escaped
#8Realtyna Organic IDX plugin + WPL Real Estate189303,6362k+Non-prefixed global variable
#9Shopping Cart & eCommerce Store185,37317,4663k+Non-prefixed global variable
#10Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution191,218901100k+Exception output is not escaped
#11Matomo Analytics – Powerful, Privacy-First Insights for WordPress191,900877100k+Exception output is not escaped
#12Razorpay Payment Button Plugin19486982k+Exception output is not escaped
#13WP Email Template193443452k+Exception output is not escaped
#14WP Import Export Lite1973797940k+Non-prefixed global variable
#15WPJAM Basic193253464k+Output is not escaped
#16WPOSS阿里云对象存储19269315900Non-prefixed namespace
#17WPQiNiu七牛云对象存储19138612400Non-prefixed global variable
#18Download Monitor204231,36480k+Non-prefixed hook name
#19Event Espresso – Event Registration & Ticketing Sales2012,6982,135600Text Domain Mismatch
#20Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non-prefixed global variable
#21پلاگین پرداخت دلخواه20584446900Text Domain Mismatch
#22Pix por Piggly (para Woocommerce)205471954k+Exception output is not escaped
#23Razorpay Payment Button Elementor Plugin20479621k+Exception output is not escaped
#24Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF20556543100k+Output is not escaped
#25Razorpay for WooCommerce20975859100k+Non-prefixed function
#26WP Minify Fix20306380800Output is not escaped
#27Backup Migration219811,09380k+Non-prefixed global variable
#28Kadence Security – Password, Two Factor Authentication, and Brute Force Protection211,060957700k+Missing Translators Comment
#29Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots211,6212,03310k+Direct Query
#30rtMedia for WordPress, BuddyPress and bbPress213636477k+Non-prefixed constant
#31Captcha Them All213003235k+Output is not escaped
#32Comet Cache2185724520k+Output is not escaped
#33DELUCKS SEO213621,171400Missing nonce verification
#34Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More212,5721,2771m+Output is not escaped
#35EventPrime – Events Calendar, Bookings and Tickets218734,3087k+Non-prefixed global variable
#36FileOrganizer – WordPress File Manager21536241200k+unlink unlink
#37Modular DS: Monitor, update, and backup multiple websites211598240k+Exception output is not escaped
#38Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4783,33710k+Non-prefixed global variable
#39Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages211,1202,9139k+Non-prefixed global variable
#40Razorpay for Gravity Forms2141147600Exception output is not escaped
#41Razorpay Quick Payments21399632k+Exception output is not escaped
#42Five Star Restaurant Reservations – WordPress Booking Plugin211,1011,15910k+Output is not escaped
#43Rocket Maintenance Mode & Coming Soon Page211,1761,4064k+Non-prefixed global variable
#44SeatReg213121,637400Missing nonce verification
#45TotalPoll for Polls and Contests211,3661551k+Text Domain Mismatch
#46Revive Social – Social Media Auto Post and Scheduling Automation Plugin2125643120k+Non-prefixed hook name
#47Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin211,0642,97540k+Direct Query
#48UPC/EAN/GTIN Barcode Generator/Importer21776311500Exception output is not escaped
#49Buckaroo Woocommerce Payments Plugin216383212k+Exception output is not escaped
#50WebP Express21160427300k+Non-prefixed global variable