PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_fwrite

file system operations fwrite

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#251All-In-One Security (AIOS) – Security and Firewall245521,2281m+Non-prefixed global variable
#252Starter Templates – AI-Powered Templates for Elementor & Gutenberg241254011m+Non-prefixed hook name
#253Auto-Install Free SSL – Generate & Install Free SSL Certificates249911,4958k+Non-prefixed global variable
#254Backuply – Backup, Restore, Migrate and Clone24704551700k+Non-prefixed global variable
#255Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale)241,8651,0891k+Text Domain Mismatch
#256Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces242,3173,37510k+slow db query meta key
#257BrikPanel: WooCommerce Dashboard, Abandoned Cart Recovery, Google Sheets Sync, Inventory Management & Bulk Editor244,3131,425500Text Domain Mismatch
#258Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More2434460940k+Non-prefixed global variable
#259Message Filter for Contact Form 7241,0571,5941k+Non-prefixed global variable
#260Kognetiks Chatbot for WordPress246511,486600Non-prefixed global variable
#261Church Admin241,5544,207900Direct Query
#262CMP – Coming Soon & Maintenance Plugin by NiteoThemes249491,336200k+Non-prefixed global variable
#263Complianz – GDPR/CCPA Cookie Consent244874031m+Missing Arg Domain
#264Contact Form by Supsystic241,9136336k+Non Singular String Literal Domain
#265WPBot – ChatBot Conversational Forms241,2541,2262k+Text Domain Mismatch
#266CRM Perks Forms – WordPress Form Builder248195771k+Output is not escaped
#267Custom CSS247036571k+Output is not escaped
#268Custom Twitter Feeds – A Tweets Widget or X Feed Widget24446922100k+Output is not escaped
#269WP Customer Area243,30694110k+Text Domain Mismatch
#270Digital License Manager24295670800Non-prefixed hook name
#271Double Opt-In for Contact Form 7 – Secure, GDPR-Compliant Email Verification242334411k+Non-prefixed hook name
#272Doubly – Cross Domain Copy Paste for WordPress242525510k+Output is not escaped
#273DSGVO All in one for WP24751,63720k+Non-prefixed global variable
#274Enable Media Replace24212276600k+Output is not escaped
#275Etsy Integration For WooCommerce241,2464,643900Non-prefixed global variable
#276F12 Profiler24282451500Direct Query
#277Fast Velocity Minify2428225640k+Unsafe printing function
#278Fattura2424312333400Output is not escaped
#279Featured Image from URL (FIFU)241,65441870k+Non Singular String Literal Domain
#280Featured Post with thumbnail24158122400Output is not escaped
#281Fix Alt Text245443461k+Non Singular String Literal Domain
#282FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution2419375380k+Direct Query
#283Formidable PRO2PDF242184771k+Non-prefixed global variable
#284Photo Gallery – Responsive Image Galleries by Supsystic242409120k+Text Domain Mismatch
#285GD Mail Queue24502582700Output is not escaped
#286GG Woo Feed for WooCommerce Shopping Feed on Google and Other Channels244695921k+Non-prefixed global variable
#287Assets manager, dequeue scripts, dequeue styles for WordPress245922552k+Output is not escaped
#288Simple Calendar – Google Calendar Plugin242,05359250k+Missing direct file access protection
#289Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN243,41086670k+Text Domain Mismatch
#290Import from YML2497306400Non-prefixed global variable
#291Import and export users and customers241,04035770k+Unsafe printing function
#292Infinite Uploads – Offload Media and Video to Cloud Storage24586722800Direct Query
#293Social Slider Feed – Social Media Feed & Gallery Widgets2492970720k+Non-prefixed global variable
#294Dynamics 365 Integration24383166600Output is not escaped
#295Koko Analytics – Privacy-Friendly WordPress Analytics2416639560k+Short PHP open tag found
#296LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes244141,17610k+Non-prefixed global variable
#297Local Delivery Drivers for WooCommerce241,8321,483900Non-prefixed global variable
#298Generate Images (AI) – Magic Post Thumbnail241,9401,7616k+Non-prefixed global variable
#299Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails244,6961,4805k+Text Domain Mismatch
#300Mang Board WP241,2134,7209k+Non-prefixed global variable