PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_is_writable

file system operations is writable

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1BulletProof Security05,0484,94920k+Output is not escaped
#2Themify Builder95,3342,1715k+Text Domain Mismatch
#3JetBackup – Backup, Restore & Migrate101,567156200k+Exception output is not escaped
#4404 Solution155821,53210k+Non-prefixed class
#5RestroPress – Online Food Ordering System175353,2341k+Non-prefixed global variable
#6WPtouch – Make your WordPress Website Mobile-Friendly171,46632550k+Text Domain Mismatch
#7Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution181,229923100k+Exception output is not escaped
#8Shopping Cart & eCommerce Store188,24018,4783k+Non-prefixed global variable
#9WPPizza – A Restaurant Plugin184,6892,7031k+Text Domain Mismatch
#10GiveWP – Donation Plugin and Fundraising Platform193,4023,555100k+Output is not escaped
#11Matomo Analytics – Powerful, Privacy-First Insights for WordPress191,993892100k+Exception output is not escaped
#12Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)195303753m+Missing Translators Comment
#13SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments195411,14680k+Non-prefixed global variable
#14WP Email Template193443452k+Exception output is not escaped
#15Broadstreet20434273800Output is not escaped
#16Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More202,8741,9881m+Non-prefixed global variable
#17EventPrime – Events Calendar, Bookings, Tickets & AI208464,2247k+Non-prefixed global variable
#18GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership201,832720700Non Singular String Literal Domain
#19Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non-prefixed global variable
#20Nimble Page Builder201,5911,68430k+Missing Arg Domain
#21Pix por Piggly (para Woocommerce)205471954k+Exception output is not escaped
#22Powered Cache – Caching and Optimization for WordPress – Easily Improve PageSpeed & Web Vitals Score201472313k+Exception output is not escaped
#23Membership Plugin – Kadence Memberships205,0893,0059k+Text Domain Mismatch
#24Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF20556543100k+Output is not escaped
#25Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools207873,41630k+Non-prefixed global variable
#26WP Compress – Instant Performance & Speed Optimization204,2923,69110k+Non Singular String Literal Domain
#27WP Minify Fix20306380800Output is not escaped
#28Backup Migration219991,08180k+Non-prefixed global variable
#29Kadence Security – Password, Two Factor Authentication, and Brute Force Protection211,060959700k+Missing Translators Comment
#30Spam protection, Honeypot, Anti-Spam by CleanTalk218351,146200k+Missing nonce verification
#31Comet Cache2185724520k+Output is not escaped
#32DELUCKS SEO213621,171300Missing nonce verification
#33Event Espresso – Event Registration & Ticketing Sales2112,7102,136600Text Domain Mismatch
#34FileOrganizer – WordPress File Manager21549261200k+unlink unlink
#35Ibtana – Ecommerce Product Addons211,5481,7186k+Non Singular String Literal Domain
#36Link Library211,9321,38710k+Unsafe printing function
#37Modular DS: Monitor, update, and backup multiple websites211998240k+Exception output is not escaped
#38Five Star Restaurant Reservations – WordPress Booking Plugin211,1011,15910k+Output is not escaped
#39SeatReg213501,842300Missing nonce verification
#40Simple Job Board216351,37610k+Non-prefixed global variable
#41Smart Forms – when you need more than just a contact form217765745k+Output is not escaped
#42Buckaroo Payments for WooCommerce216923512k+Exception output is not escaped
#43WebP Express21160427300k+Non-prefixed global variable
#44Wise Chat214705155k+Output is not escaped
#45Wordfence Security – Firewall, Malware Scan, and Login Security211,8933,2925m+Output is not escaped
#46WP-Lister Lite for eBay216,7015,1402k+Output is not escaped
#47WP phpMyAdmin214,5286,43540k+Missing Arg Domain
#48wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin211,8291,53460k+Output is not escaped
#49Ajax Load More – Infinite Scroll, Load More, & Lazy Load2264159230k+Unsafe printing function
#50ANAC XML Bandi di Gara22294244500Output is not escaped