PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_fread

file system operations fread

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#201Timber248512820k+Non-prefixed hook name
#202UpdraftPlus: WP Backup & Migration Plugin242772993m+Non-prefixed global variable
#203User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder246643,32150k+Non-prefixed global variable
#204VikRentItems Flexible Rental Management System244,7554,639600Non-prefixed global variable
#205Visitor Traffic Real Time Statistics2447393030k+Non-prefixed global variable
#206PDF Ink Lite – Free PDF Watermark & Password Protection242265612k+Non-prefixed global variable
#207WCMultiShipping — Mondial Relay, Inpost & Chronopost for WooCommerce247304995k+Output is not escaped
#208Disable Updates – Updates Manager, Disable Automatic Updates, Disable All Updates2452213510k+Output is not escaped
#209Bulk Edit Products for WooCommerce – WP Sheet Editor2494193610k+Text Domain Mismatch
#210Bulk Edit Coupons for WooCommerce – WP Sheet Editor241,006950500Text Domain Mismatch
#211Payment Plugins Braintree For WooCommerce247317552k+Output is not escaped
#212EU VAT Assistant for WooCommerce241,7424955k+Non Singular String Literal Domain
#213European VAT Compliance Assistant for WooCommerce245153173k+Output is not escaped
#214Yoast SEO – Advanced SEO with real-time guidance and built-in AI2415938610m+Non-prefixed global variable
#215WP Fastest Cache – WordPress Cache Plugin245417531m+Unsafe printing function
#216Iptanus File Upload245091,32510k+Non-prefixed function
#217WP Hotel Booking241,2321,5337k+Non-prefixed global variable
#218WP Job Portal – AI-Powered Recruitment System for Company or Job Board website24691,0898k+Missing Version
#219پارسی دیت – Parsi Date24106291100k+Non-prefixed hook name
#220WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content241,77539340k+Text Domain Mismatch
#221Bulk Edit Posts and Products in Spreadsheet249189128k+Text Domain Mismatch
#222WP-Stateless – Google Cloud Storage241,0364824k+Non Singular String Literal Domain
#223Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress242,5762,103100k+Output is not escaped
#224WP User Manager – User Profile Builder & Membership2478753910k+Exception output is not escaped
#225WPIDE – File Manager & Code Editor246101,38640k+Non-prefixed global variable
#2263DPrint Lite251751,029700Non-prefixed global variable
#227All 404 Redirect to Homepage25140301200k+date date
#228Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid2524385450k+Non-prefixed global variable
#229Booking Calendar Contact Form25371884500Input is not validated
#230Breeze Cache25218800400k+Non-prefixed global variable
#231Colissimo shipping methods for WooCommerce251,75555710k+Text Domain Mismatch
#232Disable Comments & Delete All Comments255031859k+Output is not escaped
#233DecaLog259432361k+Exception output is not escaped
#234Disable Admin Notices – Hide Dashboard Notifications25465195100k+Output is not escaped
#235GD Rating System251,5111,0431k+Output is not escaped
#236GD Security Headers254075211k+Output is not escaped
#237Site Kit by Google – Analytics, Search Console, AdSense, Speed251,3042425m+Missing direct file access protection
#238Sitemap by BestWebSoft – WordPress XML Site Map Page Generator Plugin2560820720k+Text Domain Mismatch
#239Infinite Uploads – Offload Media and Video to Cloud Storage25579720800Direct Query
#240IP Location Block2552162410k+Output is not escaped
#241IP Locator25482211600Text Domain Mismatch
#242Media Cloud Sync251,0952741k+Exception output is not escaped
#243Create251,5587696k+Text Domain Mismatch
#244PDF Importer for WPForms25332329400Non-prefixed global variable
#245PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin251,0841,2969k+Non-prefixed global variable
#246phpinfo() WP — Site Health, PHP Compatibility & Server Audit252767043k+Non-prefixed global variable
#247Quttera ThreatSign – Web Malware Scanner for WordPress2533447110k+Non-prefixed global variable
#248SEO Repair Kit – Meta Manager, Schema Manager, SEO Content Monitoring, GSC Integration, Keyword & Rank Tracking251969022k+Direct Query
#249Tamara Checkout256012282k+Exception output is not escaped
#250Taskbuilder – Project Management & Task Management Tool With Kanban Board251274,332800Non-prefixed global variable