PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_fread

file system operations fread

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsUpdatedTop Issue
#151Security Plugin, Firewall & Malware Scanner with Auto Removal241,19277030k+Output is not escaped
#152ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization2492632210k+Output is not escaped
#153MoreConvert Wishlist for WooCommerce243,6786299k+Text Domain Mismatch
#154Spotlight Social Feeds – Block, Shortcode, and Widget2441114760k+Output is not escaped
#155Tainacan241565981k+Direct Query
#156Timber248512820k+Non-prefixed hook name
#157UpdraftPlus: WP Backup & Migration Plugin242772993m+Non-prefixed global variable
#158User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder246643,31860k+Non-prefixed global variable
#159PDF Ink Lite – Free PDF Watermark & Password Protection242265612k+Non-prefixed global variable
#160WCMultiShipping — Mondial Relay, Inpost & Chronopost for WooCommerce247304995k+Output is not escaped
#161Disable Updates – Updates Manager, Disable Automatic Updates, Disable All Updates2452213510k+Output is not escaped
#162Bulk Edit Products for WooCommerce – WP Sheet Editor2494193610k+Text Domain Mismatch
#163Payment Plugins Braintree For WooCommerce247317552k+Output is not escaped
#164EU VAT Assistant for WooCommerce241,7424955k+Non Singular String Literal Domain
#165European VAT Compliance Assistant for WooCommerce245153173k+Output is not escaped
#166Yoast SEO – Advanced SEO with real-time guidance and built-in AI2415938610m+Non-prefixed global variable
#167WP Fastest Cache – WordPress Cache Plugin245417531m+Unsafe printing function
#168Iptanus File Upload245091,32510k+Non-prefixed function
#169WP Hotel Booking241,2501,5557k+Non-prefixed global variable
#170WP Job Portal – AI-Powered Recruitment System for Company or Job Board website24691,0898k+Missing Version
#171WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content241,77539340k+Text Domain Mismatch
#172Bulk Edit Posts and Products in Spreadsheet249189129k+Text Domain Mismatch
#173SlimStat Analytics241,16973770k+Exception output is not escaped
#174WP-Stateless – Google Cloud Storage241,0364824k+Non Singular String Literal Domain
#175Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress242,5762,103100k+Output is not escaped
#176WP User Manager – User Profile Builder & Membership2478753910k+Exception output is not escaped
#177WPIDE – File Manager & Code Editor246101,38640k+Non-prefixed global variable
#178All 404 Redirect to Homepage25140301200k+date date
#179Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid2524385450k+Non-prefixed global variable
#180Breeze Cache25217790400k+Non-prefixed global variable
#181Colissimo shipping methods for WooCommerce251,75555710k+Text Domain Mismatch
#182Disable Comments & Delete All Comments255031859k+Output is not escaped
#183DecaLog259432361k+Exception output is not escaped
#184Disable Admin Notices – Hide Dashboard Notifications25465195100k+Output is not escaped
#185GD Security Headers254075211k+Output is not escaped
#186Site Kit by Google – Analytics, Search Console, AdSense, Speed251,3042425m+Missing direct file access protection
#187Sitemap by BestWebSoft – WordPress XML Site Map Page Generator Plugin2560820720k+Text Domain Mismatch
#188IP Location Block2552162410k+Output is not escaped
#189Create251,5587676k+Text Domain Mismatch
#190PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin251,0841,2969k+Non-prefixed global variable
#191phpinfo() WP — Site Health, PHP Compatibility & Server Audit252767043k+Non-prefixed global variable
#192Quttera ThreatSign – Web Malware Scanner for WordPress2533447110k+Non-prefixed global variable
#193SEO Repair Kit – Meta Manager, Schema Manager, SEO Content Monitoring, GSC Integration, Keyword & Rank Tracking251969022k+Direct Query
#194Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management2538793510k+SQL query is not prepared
#195Tamara Checkout256012282k+Exception output is not escaped
#196Social Media Share Buttons & Social Sharing Icons252,4331,383100k+Unsafe printing function
#197Social Share Icons & Social Share Buttons252,3651,35710k+Output is not escaped
#198VikBooking Hotel Booking Engine & PMS2513,2328,3128k+Output is not escaped
#199VikRentCar Car Rental Management System255,5375,0484k+Non-prefixed global variable
#200W3 Total Cache256171,345900k+Non-prefixed global variable