PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_fwrite

file system operations fwrite

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#351WP Admin Audit241,0517811k+error log print r
#352WP Discourse241031141k+Nonce verification recommended
#353Iptanus File Upload245091,32510k+Non-prefixed function
#354WP Hotel Booking249011,5327k+Non-prefixed global variable
#355WP Job Portal – AI-Powered Recruitment System for Company or Job Board website24781,1588k+Missing Version
#356WP-Members Membership Plugin2466938250k+Output is not escaped
#357WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content241,77739440k+Text Domain Mismatch
#358Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress242,5812,109100k+Output is not escaped
#359WP User Manager – User Profile Builder & Membership2478753910k+Exception output is not escaped
#360WP Voting Contest Lite24259258400Text Domain Mismatch
#361WPAdverts – Classifieds Plugin241,3084964k+Output is not escaped
#362WPeMatico RSS Feed Fetcher241,37858710k+Output is not escaped
#363WPIDE – File Manager & Code Editor246121,39940k+Non-prefixed global variable
#364WPSpeed – WordPress Speed, Cache & Performance Optimization (Core Web Vitals, PageSpeed 100)244821892k+Output is not escaped
#3653DPrint Lite251751,029700Non-prefixed global variable
#366Dynamic Pricing With Discount Rules for WooCommerce251652055k+Non-prefixed global variable
#367Advanced WordPress Reset – Debug, Recover & Reset WP2547546420k+Output is not escaped
#368AliExpress Dropshipping Plugin for WooCommerce Stores255557344k+Text Domain Mismatch
#369All 404 Redirect to Homepage25140301200k+date date
#370Appointment Hour Booking – Booking Calendar252621,25310k+Non-prefixed global variable
#371Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid2524385450k+Non-prefixed global variable
#372Booking Package251,6973,97710k+Missing nonce verification
#373Breeze Cache25218800400k+Non-prefixed global variable
#374CheckoutWC Lite – Conversion optimized WooCommerce checkout251,4168543k+Text Domain Mismatch
#375CheckView – Form & Checkout Testing25663371k+Direct Query
#376Colissimo shipping methods for WooCommerce251,75555710k+Text Domain Mismatch
#377Disable Comments & Delete All Comments255031859k+Output is not escaped
#378Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress254983551k+Text Domain Mismatch
#379Contact Form Email254098989k+Non-prefixed global variable
#380Smash Balloon Social Post Feed – Simple Social Feeds for WordPress25554982200k+Output is not escaped
#381DecaLog259432361k+Exception output is not escaped
#382Disable Admin Notices – Hide Dashboard Notifications25465195100k+Output is not escaped
#383Docket Cache – Object Cache Accelerator2533348120k+Output is not escaped
#384WEB-Translation – eTranslation Multilingual252171,057400Non-prefixed function
#385Event Genius – Event Management, Events Calendar, Registration, and RSVP251811,579500Non-prefixed global variable
#386Events Made Easy255216,3241k+Non-prefixed function
#387Form Vibes – Save Contact Form 7 & Elementor Form Entries to Database257161,50910k+Non-prefixed global variable
#388FunnelKit – Funnel Builder for WooCommerce Checkout253,1642,62430k+Text Domain Mismatch
#389Gallery Images Ape255883411k+Output is not escaped
#390GD Rating System251,5111,0431k+Output is not escaped
#391GD Security Headers254075211k+Output is not escaped
#392WPBruiser {no- Captcha anti-Spam}2564625910k+Non Singular String Literal Domain
#393Site Kit by Google – Analytics, Search Console, AdSense, Speed251,3042425m+Missing direct file access protection
#394Sitemap by BestWebSoft – WordPress XML Site Map Page Generator Plugin2560820720k+Text Domain Mismatch
#395Independent Analytics – WordPress Analytics Plugin251,1482,293100k+Non-prefixed global variable
#396Smash Balloon Social Photo Feed – Easy Social Feeds Plugin254491,3001m+Interpolated SQL is not prepared
#397IP Location Block2552162410k+Output is not escaped
#398JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin251,5411,5781k+Non-prefixed global variable
#399M Chart255581,4653k+Non-prefixed global variable
#400MaxButtons – Create buttons2562640470k+Output is not escaped