PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_fsockopen

file system operations fsockopen

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1JetBackup – Backup, Restore & Migrate101,567156200k+Exception output is not escaped
#2RestroPress – Online Food Ordering System175353,2111k+Non-prefixed global variable
#3Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution181,229923100k+Exception output is not escaped
#4Matomo Analytics – Powerful, Privacy-First Insights for WordPress191,993892100k+Exception output is not escaped
#5Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)195303753m+Missing Translators Comment
#6SendPress Newsletters192,2931,4221k+Output is not escaped
#7WP Email Template193443452k+Exception output is not escaped
#8پلاگین پرداخت دلخواه20584446900Text Domain Mismatch
#9Pix por Piggly (para Woocommerce)205471954k+Exception output is not escaped
#10WP Compress – Instant Performance & Speed Optimization204,2923,69110k+Non Singular String Literal Domain
#11Booking Ultra Pro Appointments Booking Calendar Plugin217612,083400Request data is not unslashed
#12Spam protection, Honeypot, Anti-Spam by CleanTalk218331,133200k+Missing nonce verification
#13DELUCKS SEO213621,171300Missing nonce verification
#14Directorist: AI-Powered Business Directory, Listings & Classified Ads214842,32720k+Non-prefixed global variable
#15FileOrganizer – WordPress File Manager21549261200k+unlink unlink
#16Campaign Monitor for WordPress213864612k+Non-prefixed global variable
#17Link Library211,9321,38710k+Unsafe printing function
#18Mergado Pack212,323588700Output is not escaped
#19Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4363,34510k+Non-prefixed global variable
#20Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages211,1202,9138k+Non-prefixed global variable
#21Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction211,9945,33110k+Non-prefixed hook name
#22Rocket Maintenance Mode & Coming Soon Page211,1761,4064k+Non-prefixed global variable
#23Smart Forms – when you need more than just a contact form217765745k+Output is not escaped
#24Buckaroo Payments for WooCommerce216923512k+Exception output is not escaped
#25Wordfence Security – Firewall, Malware Scan, and Login Security211,8933,2925m+Output is not escaped
#26WP-Lister Lite for eBay216,7015,1402k+Output is not escaped
#27Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8541,26940k+Text Domain Mismatch
#28RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login223,6555,1608k+Non-prefixed global variable
#29Ebook Store224061,076700Non-prefixed global variable
#30FACTO – Facturación Electrónica22258450300Request data is not unslashed
#31Fastcache by Host.it221,3352061k+Text Domain Mismatch
#32File Manager Pro – Filester22584411100k+Request data is not unslashed
#33MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder221,1203,0122k+Non-prefixed global variable
#34Newsletters222,9862,2542k+Text Domain Mismatch
#35Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App221,6022,342300k+Non-prefixed global variable
#36Quick Contact Form222606231k+Non-prefixed function
#37ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF221,047802300k+Non-prefixed global variable
#38Slim Jetpack222,5861,9472k+Text Domain Mismatch
#39SSL Zen — SSL Certificate Installer & HTTPS Redirects227511,60510k+Non-prefixed global variable
#40Welcart e-Commerce2210,35010,87510k+Text Domain Mismatch
#41Paysera Payment Gateway for WooCommerce221,8701987k+Exception output is not escaped
#42File Manager227405201m+Unsafe printing function
#43WP Umbrella: Security Backup Restore & Monitoring221,0011,19180k+Exception output is not escaped
#44WP-WebAuthn229573962k+Exception output is not escaped
#45YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports221,36647710k+Offloaded Content
#46Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels232,6933,77110k+slow db query meta key
#47Geo Controller23874841k+Non-prefixed global variable
#48DK PDF – WordPress PDF Generator237443353k+Exception output is not escaped
#49FV Flowplayer Video Player231,2801,45610k+Output is not escaped
#50Simple Calendar – Google Calendar Plugin232,15361250k+Missing direct file access protection