PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_is_writable

file system operations is writable

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1BulletProof Security05,0484,94920k+Output is not escaped
#2Themify Builder95,2092,1255k+Text Domain Mismatch
#3JetBackup – Backup, Restore & Migrate101,563149200k+Exception output is not escaped
#4Visual Composer Website Builder168232040k+Non-prefixed global variable
#5RestroPress – Online Food Ordering System175243,1551k+Non-prefixed global variable
#6WPtouch – Make your WordPress Website Mobile-Friendly171,46632550k+Text Domain Mismatch
#7Realtyna Organic IDX plugin + WPL Real Estate189303,6362k+Non-prefixed global variable
#8Shopping Cart & eCommerce Store185,37317,4663k+Non-prefixed global variable
#9WPPizza – A Restaurant Plugin184,6892,7031k+Text Domain Mismatch
#10Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons1910,340360100k+Text Domain Mismatch
#11Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution191,218901100k+Exception output is not escaped
#12Matomo Analytics – Powerful, Privacy-First Insights for WordPress191,900877100k+Exception output is not escaped
#13Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)195363793m+Missing Translators Comment
#14Membership Plugin – Kadence Memberships195,0822,9829k+Text Domain Mismatch
#15SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments195331,14980k+Non-prefixed global variable
#16WP Email Template193443452k+Exception output is not escaped
#17WP Import Export Lite1973797940k+Non-prefixed global variable
#18Broadstreet20434273700Output is not escaped
#19Event Espresso – Event Registration & Ticketing Sales2012,6982,135600Text Domain Mismatch
#20GiveWP – Donation Plugin and Fundraising Platform203,4113,559100k+Output is not escaped
#21GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership201,832720700Non Singular String Literal Domain
#22Link Library201,9421,39410k+Unsafe printing function
#23Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non-prefixed global variable
#24Nimble Page Builder201,5911,68430k+Missing Arg Domain
#25Pix por Piggly (para Woocommerce)205471954k+Exception output is not escaped
#26Powered Cache – Caching and Optimization for WordPress – Easily Improve PageSpeed & Web Vitals Score201472313k+Exception output is not escaped
#27Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF20556543100k+Output is not escaped
#28WP Minify Fix20306380800Output is not escaped
#29Store Locator WordPress212,4941,62810k+Text Domain Mismatch
#30Backup Migration219811,09380k+Non-prefixed global variable
#31Kadence Security – Password, Two Factor Authentication, and Brute Force Protection211,060957700k+Missing Translators Comment
#32rtMedia for WordPress, BuddyPress and bbPress213636477k+Non-prefixed constant
#33CartFlows – Funnel Builder & Checkout Plugin for WooCommerce21462656200k+Text Domain Mismatch
#34Comet Cache2185724520k+Output is not escaped
#35DELUCKS SEO213621,171400Missing nonce verification
#36Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More212,5721,2771m+Output is not escaped
#37EventPrime – Events Calendar, Bookings and Tickets218734,3087k+Non-prefixed global variable
#38FileOrganizer – WordPress File Manager21536241200k+unlink unlink
#39Modular DS: Monitor, update, and backup multiple websites211598240k+Exception output is not escaped
#40Five Star Restaurant Reservations – WordPress Booking Plugin211,1011,15910k+Output is not escaped
#41SeatReg213121,637400Missing nonce verification
#42Smart Forms – when you need more than just a contact form217765745k+Output is not escaped
#43Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin211,0642,97540k+Direct Query
#44Buckaroo Woocommerce Payments Plugin216383212k+Exception output is not escaped
#45WebP Express21160427300k+Non-prefixed global variable
#46Wise Chat214705065k+Output is not escaped
#47Paysera Payment Gateway for WooCommerce211,8681967k+Exception output is not escaped
#48WooCommerce211,3436,2127m+Non-prefixed global variable
#49Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools217863,39730k+Non-prefixed global variable
#50Wordfence Security – Firewall, Malware Scan, and Login Security211,5922,9735m+Output is not escaped