PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_is_writable

file system operations is writable

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#551Gravatar Enhanced – Avatars, Profiles, and Privacy513848100k+Dynamic hook name
#552Known Agents – Track AI Bots and Crawlers, Block Scrapers, Analyze LLM Referral Traffic5737121k+Setting is missing a sanitization callback
#553Longer Permalinks5727218k+Missing Arg Domain
#554WP Table Builder – Drag & Drop Table Builder57633950k+Not Allowed
#555PDF invoice for WP ERP58961342k+Non-prefixed global variable
#556WC Korkmaz Contract – Contracts for WooCommerce59738500Non-prefixed global variable
#557Surge6046474k+Non-prefixed global variable
#558Ads.txt Manager6133164k+Text Domain Mismatch
#559Falcon – WordPress Optimizations & Tweaks6247662k+Short PHP open tag found
#560Easy SSL Plugin for SAKURA Rental Server62231750k+Input is not sanitized
#561Image Sitemap631114400Output is not escaped
#562WP-Farsi652636600Non-prefixed function
#563WPAdmin AWS CDN6616142500Text Domain Mismatch
#564Debug Log Manager – Conveniently Monitor and Inspect Errors66334410k+Input is not validated
#565Easy PHP Settings6634481k+Missing Translators Comment
#566Printful Integration for WooCommerce672187650k+Text Domain Mismatch
#567Protection Against DDoS682253k+Output is not escaped
#568WPThumb70309800Output is not escaped
#569Nginx Helper714760200k+Non-prefixed global variable
#570TinyPNG – JPEG, PNG & WebP image compression724073100k+Non-prefixed global variable
#571Emergency password reset735614800wp function not compatible with requires wp
#572Post Sliders & Post Grids736431k+Request data is not unslashed
#573Image Quality Control | Still BE747128400Missing Translators Comment
#574Registration Form for WooCommerce75542900Non-prefixed global variable
#575Spider Blocker7819920k+Missing Translators Comment
#576Responsive Mobile-Friendly Tooltip792514600Missing Arg Domain
#577Antispam Bee80438700k+Nonce verification recommended
#578Gravity Forms CLI Add-On8131420k+Missing direct file access protection
#579WPLANG Lite8485400trademarked term
#580FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More85123271k+Non-prefixed global variable
#581Salt Shaker8515136k+Interpolated SQL is not prepared
#582Hotfix861184k+Deprecated class: services_json
#583WP-Memory-Usage894910k+Interpolated SQL is not prepared
#584Post Export Import with Media9034411k+Missing Translators Comment
#585Hotlink File Prevention9161600file system operations is writable
#586MultiManager WP – Manage All Your WordPress Sites Easily9128111k+Missing Arg Domain
#587Snow Monkey Forms91364130k+Non-prefixed global variable
#588Super Light Cache Buster9164700Non-prefixed function
#589WP Force SSL & HTTPS SSL Redirect92182190k+Non-prefixed global variable
#590OptionTree93165250k+Text Domain Mismatch
#591Speed Up – Browser Caching95132700file system operations is writable
#592Enable SVG, WebP, and ICO Upload96121610k+Non-prefixed global variable
#593GenerateBlocks9798200k+file system operations is writable
#594Performant Translations975940k+Non-prefixed global variable
#595Manage XML-RPC98315k+file system operations is writable
#596WP Debugging991510k+trademarked term