PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_fread

file system operations fread

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#151WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel231,1583,64220k+Interpolated SQL is not prepared
#1521 Click Migration & Backup: Free WordPress Migration Plugin with Zero Downtime & Easy Clone24140193400Direct Query
#153404 Solution244831,35510k+Non-prefixed class
#154Backuply – Backup, Restore, Migrate and Clone24711556600k+Non-prefixed global variable
#155Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale)241,8651,0891k+Text Domain Mismatch
#156Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces242,3173,37510k+slow db query meta key
#157Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More2436463740k+Non-prefixed global variable
#158Kognetiks Chatbot for WordPress246511,486600Non-prefixed global variable
#159Church Admin241,5564,200900Direct Query
#160Contact Form by Supsystic241,8846226k+Non Singular String Literal Domain
#161WP Customer Area243,30694110k+Text Domain Mismatch
#162Defender Security – Malware Scanner, Login Security & Firewall2455059380k+Non-prefixed namespace
#163Disable Admin Notices – Hide Dashboard Notifications24464195100k+Output is not escaped
#164DSGVO All in one for WP24751,63720k+Non-prefixed global variable
#165Easy Optimizer – PageSpeed, Cache & Core Web Vitals (Unused CSS, Delay JS, Lazy Load)24194514500Direct Query
#166Export WordPress Pages to Static HTML & PDF — Static Site Export245093044k+Text Domain Mismatch
#167Fast Velocity Minify2428325440k+Unsafe printing function
#168Featured Post with thumbnail24158122400Output is not escaped
#169Filr – Secure document library245901,315800Non-prefixed global variable
#170Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder244,7451,27930k+Non Singular String Literal Domain
#171Photo Gallery – Responsive Image Galleries by Supsystic242428820k+Text Domain Mismatch
#172Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress2453632210k+Text Domain Mismatch
#173GD Mail Queue24502582700Output is not escaped
#174Assets manager, dequeue scripts, dequeue styles for WordPress245922552k+Output is not escaped
#175Simple Calendar – Google Calendar Plugin242,14761150k+Missing direct file access protection
#176Infinite Uploads – Offload, Optimize & Organize Your Media Library24588723800Direct Query
#177Social Slider Feed – Social Media Feed & Gallery Widgets2492770610k+Non-prefixed global variable
#178InstaWP Connect – 1-click WP Staging & Migration2425481540k+Non-prefixed global variable
#179LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes244071,19210k+Non-prefixed global variable
#180Generate Images (AI) – Magic Post Thumbnail241,9401,7615k+Non-prefixed global variable
#181Mang Board WP241,2134,7208k+Non-prefixed global variable
#182MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings241676285k+Non-prefixed global variable
#183Newsletter Subscription Form – User Subscriptions Form, Capture Email243858291k+Non-prefixed global variable
#184NEX-Forms – Ultimate Forms Plugin for WordPress241,9721,1926k+Text Domain Mismatch
#185Patchstack – WordPress & Plugins Security2410447850k+Missing nonce verification
#186PDF Generator for WordPress Elementor245132711k+Exception output is not escaped
#187Database Manager – WP Adminer241,0052,75220k+Non-prefixed global variable
#188Post Status Notifier Lite24984451700Missing direct file access protection
#189Post Affiliate Pro24293335500Nonce verification recommended
#190Quick Event Manager241523881k+Non-prefixed function
#191RSFirewall!245635214k+Output is not escaped
#192SecuPress with Simple SSL – Simple and Performant Security241,6951,60040k+Non-prefixed global variable
#193SEO Redirection Plugin – 301 Redirect Manager2427272510k+Non-prefixed global variable
#194Servebolt Optimizer241,9586811k+Text Domain Mismatch
#195ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization2492632210k+Output is not escaped
#196MoreConvert Wishlist for WooCommerce243,6816299k+Text Domain Mismatch
#197Softaculous241155010k+file system operations fread
#198Spotlight Social Feeds – Block, Shortcode, and Widget2441114760k+Output is not escaped
#199Tainacan241385921k+Direct Query
#200Timber248512820k+Non-prefixed hook name