WordPress.WP.AlternativeFunctions.file_system_operations_fwrite
file system operations fwrite
The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.
Why It Shows Up
Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.
Why It Matters
WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.
How to Fix
- Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
- Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
- Never write PHP code from user input or remote responses.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #451 | ezCache | 26 | 127 | 288 | 10k+ | Direct Query | ||
| #452 | Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager | 26 | 113 | 597 | 90k+ | Non-prefixed global variable | ||
| #453 | FV Antispam | 26 | 332 | 239 | 900 | Output is not escaped | ||
| #454 | Icegram Collect – Easy Form, Lead Collection and Subscription plugin | 26 | 423 | 292 | 2k+ | Output is not escaped | ||
| #455 | Integrate Razorpay for Contact Form 7 | 26 | 152 | 97 | 500 | curl curl setopt | ||
| #456 | Klarna for WooCommerce | 26 | 284 | 507 | 30k+ | Dynamic hook name | ||
| #457 | Landing Page Cat – Coming Soon & Maintenance Pages | 26 | 91 | 180 | 600 | Non-prefixed class | ||
| #458 | Login Widget With Shortcode | 26 | 335 | 198 | 6k+ | wp function not compatible with requires wp | ||
| #459 | Media File Renamer: Rename for better SEO (AI-Powered) | 26 | 154 | 170 | 40k+ | Direct Query | ||
| #460 | Hotel Booking | 26 | 690 | 940 | 4k+ | Unsafe printing function | ||
| #461 | Paytium: Mollie payment forms & donations | 26 | 506 | 551 | 3k+ | Unsafe printing function | ||
| #462 | Crowdsignal Dashboard – Polls, Surveys & more | 26 | 481 | 491 | 200k+ | Unsafe printing function | ||
| #463 | Pressidium Cookie Consent | 26 | 203 | 95 | 10k+ | Exception output is not escaped | ||
| #464 | RestaurantPress | 26 | 265 | 518 | 600 | Output is not escaped | ||
| #465 | SP Move Login | 26 | 881 | 215 | 6k+ | Text Domain Mismatch | ||
| #466 | Sliced Invoices – WordPress Invoice Plugin | 26 | 684 | 455 | 5k+ | Output is not escaped | ||
| #467 | URL Image Importer – Import External Images to the Media Library from URL, CSV & XML | 26 | 143 | 239 | 700 | Missing nonce verification | ||
| #468 | User Avatar | 26 | 104 | 173 | 4k+ | Non-prefixed constant | ||
| #469 | User Submitted Posts – Enable Users to Submit Posts from the Front End | 26 | 699 | 396 | 10k+ | Text Domain Mismatch | ||
| #470 | Visitors Online by BestWebSoft | 26 | 512 | 269 | 1k+ | Text Domain Mismatch | ||
| #471 | Polls CP | 27 | 399 | 500 | 400 | Output is not escaped | ||
| #472 | Cyrlitera – Transliteration of Links and File Names | 27 | 453 | 204 | 40k+ | Output is not escaped | ||
| #473 | EZ SQL Reports Shortcode Widget and DB Backup | 27 | 165 | 158 | 500 | Output is not escaped | ||
| #474 | Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin | 27 | 122 | 135 | 3k+ | Non-prefixed global variable | ||
| #475 | Login for Google Apps | 27 | 139 | 85 | 10k+ | Exception output is not escaped | ||
| #476 | iQ Block Country | 27 | 164 | 245 | 20k+ | Request data is not unslashed | ||
| #477 | Ray Enterprise Translation | 27 | 87 | 606 | 8k+ | Non-prefixed global variable | ||
| #478 | LWS Optimize – All-in-One Speed Booster & Cache Tools | 27 | 34 | 518 | 10k+ | Non-prefixed global variable | ||
| #479 | MW WP Form | 27 | 334 | 219 | 200k+ | Output is not escaped | ||
| #480 | Packlink PRO for WooCommerce | 27 | 132 | 160 | 20k+ | Non-prefixed global variable | ||
| #481 | Rate My Post – Star Rating Plugin by FeedbackWP | 27 | 222 | 360 | 20k+ | Output is not escaped | ||
| #482 | Robokassa payment gateway for Woocommerce | 27 | 95 | 211 | 3k+ | Non-prefixed global variable | ||
| #483 | Sign-up Sheets | 27 | 325 | 363 | 1k+ | Output is not escaped | ||
| #484 | Speed Booster Pack ⚡ PageSpeed Optimization Suite | 27 | 108 | 187 | 9k+ | Missing Translators Comment | ||
| #485 | Stream Video Player | 27 | 220 | 135 | 600 | Output is not escaped | ||
| #486 | Theme One Click Demo Importer | 27 | 210 | 157 | 500 | Text Domain Mismatch | ||
| #487 | Verge3D Publishing and E-Commerce | 27 | 245 | 298 | 400 | Nonce verification recommended | ||
| #488 | Mihdan: Ajax Edit Comments | 27 | 1,300 | 523 | 400 | Text Domain Mismatch | ||
| #489 | Content Pilot – Autoblogging & Affiliate Marketing Suite | 27 | 299 | 269 | 900 | Output is not escaped | ||
| #490 | WP-DBManager | 27 | 386 | 304 | 60k+ | Non-prefixed global variable | ||
| #491 | WP Events Manager | 27 | 294 | 415 | 30k+ | Output is not escaped | ||
| #492 | WP Hide & Security Enhancer | 27 | 124 | 375 | 50k+ | Input is not sanitized | ||
| #493 | WP Activity Log | 27 | 96 | 230 | 300k+ | Nonce verification recommended | ||
| #494 | WPBase Cache | 27 | 189 | 113 | 2k+ | Text Domain Mismatch | ||
| #495 | Redirection for Contact Form 7 | 27 | 34 | 374 | 200k+ | Non-prefixed global variable | ||
| #496 | Code Engine – PHP Snippets, AI Functions & Automation for WordPress | 28 | 124 | 96 | 700 | Non Singular String Literal Domain | ||
| #497 | Database Cleaner | 28 | 139 | 294 | 10k+ | Direct Query | ||
| #498 | Dynamic User Directory | 28 | 403 | 256 | 1k+ | Output is not escaped | ||
| #499 | Event Tickets Manager for WooCommerce | 28 | 182 | 655 | 1k+ | Non-prefixed global variable | ||
| #500 | Reviews and Rating – Google Reviews | 28 | 343 | 219 | 20k+ | Text Domain Mismatch |
