PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_fwrite

file system operations fwrite

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1BulletProof Security05,0484,94920k+Output is not escaped
#2Intercom060716k+Non-prefixed function
#3Live Shopping & Shoppable Videos For WooCommerce079174400Non-prefixed global variable
#4Plugin Check (PCP)012814010k+Non-prefixed global variable
#5JetBackup – Backup, Restore & Migrate101,567156200k+Exception output is not escaped
#6404 Solution155821,53210k+Non-prefixed class
#7MDTF – Meta Data and Taxonomies Filter161,5501,9561k+Non-prefixed global variable
#8AnyComment174454495k+Output is not escaped
#9RestroPress – Online Food Ordering System175353,2341k+Non-prefixed global variable
#10Efí Bank17886553300Exception output is not escaped
#11Shopping Cart & eCommerce Store177,49217,5543k+Non-prefixed global variable
#12wpForo Forum174,2923,02620k+Unsafe printing function
#13WPtouch – Make your WordPress Website Mobile-Friendly171,46632550k+Text Domain Mismatch
#14Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution181,229923100k+Exception output is not escaped
#15Pagopar – WooCommerce Gateway185301,215400Non-prefixed global variable
#16Block Slider – Responsive Image Slider, Video Slider & Post Slider195551,2913k+Non-prefixed global variable
#17GiveWP – Donation Plugin and Fundraising Platform193,4023,555100k+Output is not escaped
#18Matomo Analytics – Powerful, Privacy-First Insights for WordPress191,993892100k+Exception output is not escaped
#19Netgsm193523481k+Non-prefixed global variable
#20Razorpay Payment Button Plugin19486982k+Exception output is not escaped
#21Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)195303753m+Missing Translators Comment
#22Scrollsequence – Cinematic Scroll Image Animation Plugin198781,5283k+Non-prefixed global variable
#23SendPress Newsletters192,2931,4221k+Output is not escaped
#24WP Email Template193443452k+Exception output is not escaped
#25WPOSS阿里云对象存储19269315900Non-prefixed namespace
#26Broadstreet20434273800Output is not escaped
#27Download Monitor204231,36780k+Non-prefixed hook name
#28Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More202,8781,9881m+Non-prefixed global variable
#29EventPrime – Events Calendar, Bookings, Tickets & AI208464,2247k+Non-prefixed global variable
#30MAS Videos205191,6931k+Non-prefixed global variable
#31Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non-prefixed global variable
#32Pix por Piggly (para Woocommerce)205471954k+Exception output is not escaped
#33Powered Cache – Caching and Optimization for WordPress – Easily Improve PageSpeed & Web Vitals Score201472313k+Exception output is not escaped
#34Razorpay Payment Button Elementor Plugin20479621k+Exception output is not escaped
#35Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF20556543100k+Output is not escaped
#36Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools207873,41630k+Non-prefixed global variable
#37WP Compress – Instant Performance & Speed Optimization204,2923,69110k+Non Singular String Literal Domain
#38WP Minify Fix20306380800Output is not escaped
#39Backup Migration219991,08180k+Non-prefixed global variable
#40Kadence Security – Password, Two Factor Authentication, and Brute Force Protection211,060959700k+Missing Translators Comment
#41Booking Ultra Pro Appointments Booking Calendar Plugin217612,083400Request data is not unslashed
#42Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots211,6732,18010k+Direct Query
#43Captcha Them All213003235k+Output is not escaped
#44Comet Cache2185724520k+Output is not escaped
#45DELUCKS SEO213621,171300Missing nonce verification
#46Envo Extra2187760020k+Text Domain Mismatch
#47Event Espresso – Event Registration & Ticketing Sales2112,7102,136600Text Domain Mismatch
#48Feeds for YouTube (YouTube video, channel, and gallery plugin)21503995100k+Output is not escaped
#49FileOrganizer – WordPress File Manager21549261200k+unlink unlink
#50Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More21562,148300k+Non-prefixed global variable