PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_fwrite

file system operations fwrite

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#51Comet Cache2185724520k+Output is not escaped
#52Daily Prayer Time219471,7801k+Non-prefixed global variable
#53DELUCKS SEO213621,171400Missing nonce verification
#54Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More212,5721,2771m+Output is not escaped
#55Ebook Store216661,087700Non-prefixed global variable
#56Envo Extra2187860020k+Text Domain Mismatch
#57EventPrime – Events Calendar, Bookings and Tickets218734,3087k+Non-prefixed global variable
#58Feeds for YouTube (YouTube video, channel, and gallery plugin)21558978100k+Output is not escaped
#59FileOrganizer – WordPress File Manager21536241200k+unlink unlink
#60Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More21521,959300k+Non-prefixed global variable
#61Campaign Monitor for WordPress213864612k+Non-prefixed global variable
#62MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder211,1333,0112k+Non-prefixed global variable
#63Mergado Pack212,323588700Output is not escaped
#64Modular DS: Monitor, update, and backup multiple websites211598140k+Exception output is not escaped
#65Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4783,33710k+Non-prefixed global variable
#66Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages211,1202,9139k+Non-prefixed global variable
#67Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction211,9345,24810k+Non-prefixed hook name
#68User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor217021,46350k+Missing Translators Comment
#69Razorpay for Gravity Forms2141147600Exception output is not escaped
#70Razorpay Quick Payments21399633k+Exception output is not escaped
#71Five Star Restaurant Reservations – WordPress Booking Plugin211,0991,14710k+Output is not escaped
#72Rocket Maintenance Mode & Coming Soon Page211,1761,4064k+Non-prefixed global variable
#73Royal Addons for Elementor – Addons and Templates Kit for Elementor2113,0112,530600k+Text Domain Mismatch
#74SeatReg213121,637400Missing nonce verification
#75Smart Forms – when you need more than just a contact form217765745k+Output is not escaped
#76TotalPoll for Polls and Contests211,3661551k+Text Domain Mismatch
#77UPC/EAN/GTIN Barcode Generator/Importer21776311500Exception output is not escaped
#78URL Shortify – Simple and Easy URL Shortener211,5192,68710k+Non-prefixed global variable
#79Buckaroo Woocommerce Payments Plugin216383212k+Exception output is not escaped
#80Wise Chat214705065k+Output is not escaped
#81Paysera Payment Gateway for WooCommerce211,8661957k+Exception output is not escaped
#82Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools217863,39530k+Non-prefixed global variable
#83PPOM – Product Addons & Custom Fields for WooCommerce213361,32220k+Non-prefixed global variable
#84Wordfence Security – Firewall, Malware Scan, and Login Security211,5922,9735m+Output is not escaped
#85WP Compress – Instant Performance & Speed Optimization213,3673,25310k+Non Singular String Literal Domain
#86WP-Lister Lite for eBay216,6975,1292k+Output is not escaped
#87WP phpMyAdmin214,5286,43550k+Missing Arg Domain
#88wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin211,8111,43270k+Output is not escaped
#89WP Extended – The Ultimate WordPress Toolkit211,253398600Non Singular String Literal Domain
#90ANAC XML Bandi di Gara22294244600Output is not escaped
#91Backup Bolt225801,313800Non-prefixed global variable
#92Borderless – Addons and Templates for Elementor224381,3885k+Non-prefixed global variable
#93Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots221,6072,02010k+Direct Query
#94Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8581,27050k+Text Domain Mismatch
#95Code Profiler – WordPress Performance Profiling and Debugging Made Easy222654008k+Non-prefixed global variable
#96RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login223,6535,0848k+Non-prefixed global variable
#97Data Tables Generator by Supsystic2215815210k+Exception output is not escaped
#98Database Access with Adminer229832,5531k+Non-prefixed global variable
#99Download Manager222,5131,462100k+Output is not escaped
#100Dynamic QR Code – generator222382086k+Missing direct file access protection