PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_fwrite

file system operations fwrite

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#401Media Cleaner: Clean your WordPress!2526354690k+Direct Query
#402Media Cloud Sync251,0952741k+Exception output is not escaped
#403Create251,6377646k+Text Domain Mismatch
#404PDF Importer for WPForms25332329400Non-prefixed global variable
#405PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin251,0841,2969k+Non-prefixed global variable
#406Piotnet Forms251873743k+Alternative PHP tag found
#407Post Snippets – Custom WordPress Code Snippets Customizer258081,65420k+Non-prefixed global variable
#408Quttera ThreatSign – Web Malware Scanner for WordPress2533447110k+Non-prefixed global variable
#409reSmush.it : The original free image compressor and optimizer plugin2515569100k+Output is not escaped
#410BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript252045464k+Non-prefixed global variable
#411SEO Repair Kit – Meta Manager, Schema Manager, SEO Content Monitoring, GSC Integration, Keyword & Rank Tracking251969022k+Direct Query
#412Simple Link Directory – AI Powered251334202k+Non-prefixed global variable
#413Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin2595873860k+Text Domain Mismatch
#414Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator256481,0211k+Output is not escaped
#415Tamara Checkout256012282k+Exception output is not escaped
#416Taskbuilder – Project Management & Task Management Tool With Kanban Board251274,332800Non-prefixed global variable
#417TranslatePress – Translate Multilingual sites with AI Translation254991,639400k+Non-prefixed hook name
#418Spectra Legacy – Gutenberg Blocks252533,2261m+Non-prefixed global variable
#419Ultimate Blocks – 25+ Gutenberg Blocks for Block Editor256911,58150k+Non-prefixed global variable
#420VikAppointments Services Booking Calendar259,7535,207500Output is not escaped
#421VikBooking Hotel Booking Engine & PMS2513,2448,3148k+Output is not escaped
#422VikRentCar Car Rental Management System255,5375,0484k+Non-prefixed global variable
#423VikRestaurants Table Reservations and Take-Away2511,6444,932600Output is not escaped
#424weForms – Easy Drag & Drop Contact Form Builder For WordPress2591645010k+Output is not escaped
#425PDF Builder for WooCommerce. Create invoices,packing slips and more253725032k+Non-prefixed global variable
#426Wordfence Login Security2524841860k+Output is not escaped
#427Super Page Cache – Cloudflare Cache, Page Speed & Core Web Vitals2513735360k+Input is not sanitized
#428Comments Extra Fields For Post,Pages and CPT25577418500Text Domain Mismatch
#429WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards251,4311,27010k+Output is not escaped
#430WP Review Slider251,1862,2796k+Non-prefixed global variable
#431WP Go Maps – Google Map, OpenStreetMap, Leaflet Map254,9961,008300k+Unsafe printing function
#432WP Encryption – No.1 HTTPS plugin & One Click Free SSL Cert, HTTPS Redirect, SSL Security258751,76450k+Non-prefixed global variable
#433WP Photo Album Plus2541,80710k+Direct Query
#434WP-Polls2561863940k+Unsafe printing function
#435Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF2515811860k+Non-prefixed global variable
#436SlimStat Analytics251,17787070k+Exception output is not escaped
#437Smush – Image Optimization, Compression, Lazy Load, WebP & CDN252445681m+Non-prefixed hook name
#438WP Statistics – Simple, privacy-friendly Google Analytics alternative256102,465600k+Non-prefixed global variable
#439WP Super Cache258009891m+Output is not escaped
#440WP Time Slots Booking Form254391,1371k+Non-prefixed global variable
#441WPvivid Backup for MainWP258181,79410k+Missing nonce verification
#442WPvivid — Backup, Migration & Staging259001,461900k+Non-prefixed namespace
#443Backup, Restore and Migrate your sites with XCloner2523886410k+Input is not sanitized
#444ActiveCampaign for WooCommerce265411905k+Exception output is not escaped
#445Attesa Extra263161511k+Output is not escaped
#446Blog Floating Button267052409k+Output is not escaped
#447Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar265262635k+Output is not escaped
#448Database for Contact Form 7, WPforms, Elementor forms2631748960k+Non-prefixed global variable
#449Ditty – Responsive News Tickers, Sliders, and Lists2656148430k+Output is not escaped
#450ELEX WooCommerce Google Shopping (Google Product Feed)262262421k+Text Domain Mismatch