PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_fwrite

file system operations fwrite

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#101easyReservations225,3072,480800Text Domain Mismatch
#102Events Manager – Calendar, Bookings, Tickets, and more!224,7135,66070k+Output is not escaped
#103File Manager Pro – Filester22566391100k+Request data is not unslashed
#104Finale Lite – Sales Countdown Timer & Discount for WooCommerce221,0314514k+Output is not escaped
#105Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder22407236700k+Text Domain Mismatch
#106GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4663,97210k+Output is not escaped
#107Heureka22557254400Exception output is not escaped
#108Csomagpontok és Címkék WooCommerce-hez222,0017697k+Text Domain Mismatch
#109Insert or Embed Articulate Content into WordPress226591,4372k+Non-prefixed global variable
#110Számlázz.hu integráció WooCommerce-hez221,1694607k+Text Domain Mismatch
#111The Innovative Form Builder – IvyForms22713250600Exception output is not escaped
#112InfiniteWP Client222,2861,812200k+Exception output is not escaped
#113Import WP – Export and Import CSV and XML files to WordPress225803304k+Exception output is not escaped
#114JCH Optimize221,1451364k+Output is not escaped
#115Jetpack – WP Security, Backup, Speed, & Growth222,9751,3483m+Text Domain Mismatch
#116Jim Soft Swiss QR Invoice22263392400Non-prefixed global variable
#117Mail Baby SMTP22385699600SQL query is not prepared
#118MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.222,6252,45810k+Output is not escaped
#119Newsletters222,9682,2482k+Text Domain Mismatch
#120NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall221,2722,063100k+Non-prefixed global variable
#121Packeta228013338k+Exception output is not escaped
#122PDF Builder for WPForms22321266900SQL query is not prepared
#123Smart Popup by Supsystic223,17250310k+Non Singular String Literal Domain
#124Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App221,5812,326300k+Non-prefixed global variable
#125Premium Addons for Elementor – Powerful Elementor Templates & Widgets222331,036700k+Non-prefixed hook name
#126Prime Mover – Migrate WordPress Website & Backups221,3261,60010k+Non-prefixed global variable
#127Product Catalog Feed by PixelYourSite225813578k+Output is not escaped
#128PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP229844075k+Unsafe printing function
#129Quick Contact Form222606231k+Non-prefixed function
#130Social Sharing Plugin – Sassy Social Share221,689233100k+wp function not compatible with requires wp
#131Seraphinite Accelerator2259425550k+Output is not escaped
#132ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF221,044800300k+Non-prefixed global variable
#133Simple Job Board226341,35510k+Non-prefixed global variable
#134Slim Jetpack222,5861,9472k+Text Domain Mismatch
#135SNS Count Cache229181208k+Non Singular String Literal Domain
#136SSL Zen — SSL Certificate Installer & HTTPS Redirects227511,60510k+Non-prefixed global variable
#137The Moneytizer227512711k+Text Domain Mismatch
#138Theme Editor2279868550k+Output is not escaped
#139Customize Feeds for Twitter22921714k+Non-prefixed global variable
#140Search & Replace Everything – Quick and Easy Way to Find and Replace Text, Links221,0441,79720k+Non-prefixed global variable
#141Welcart e-Commerce2210,37810,93110k+Text Domain Mismatch
#142UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds22444243200k+Text Domain Mismatch
#143WCFM – Frontend Manager for WooCommerce224,7545,05420k+Non-prefixed global variable
#144WCFM Marketplace – Multivendor Marketplace for WooCommerce221,9341,96610k+Non-prefixed global variable
#145WCFM Membership – WooCommerce Memberships for Multivendor Marketplace2255967510k+Non-prefixed global variable
#146Wenprise WeChatPay Payment Gateway For WooCommerce22443178400Exception output is not escaped
#147WooCommerce221,3596,1727m+Non-prefixed global variable
#148Simple Shopping Cart2279653610k+Unsafe printing function
#149ManageWP Worker225075651m+Non-prefixed class
#150File Manager227405201m+Unsafe printing function