PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_is_writable

file system operations is writable

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsUpdatedTop Issue
#101Autoptimize23288191800k+Output is not escaped
#102Kadence Security – Password, Two Factor Authentication, and Brute Force Protection231,053967700k+Missing Translators Comment
#103Cart Notices for WooCommerce236504712k+Text Domain Mismatch
#104WPBot – AI ChatBot for Live Support, Lead Generation, AI Services232641,0385k+Non-prefixed global variable
#105CleanTalk Anti-Spam. Spam Firewall & Bot protection238261,078200k+Missing nonce verification
#106Content Egg – Affiliate Product Importer & Price Comparison231,2311,25710k+Non-prefixed global variable
#107DK PDF – WordPress PDF Generator237443353k+Exception output is not escaped
#108Easy Digital Downloads – eCommerce Payments and Subscriptions made easy233,72310,28340k+Non-prefixed namespace
#109Error Log Monitor236941,41420k+Non-prefixed global variable
#110Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI233951,34290k+Non-prefixed global variable
#111Export WordPress Pages to Static HTML & PDF — Static Site Export234903015k+Text Domain Mismatch
#112Ezoic2343251610k+Output is not escaped
#113Fuse Social Floating Sidebar231,8401,57310k+Non-prefixed global variable
#114Futurio Extra2378720520k+Text Domain Mismatch
#115Gmedia Photo Gallery233501,1217k+Non-prefixed global variable
#116Interactive Content – H5P2356538040k+Non Singular String Literal Domain
#117Payment forms, Buy now buttons, and Invoicing System | GetPaid233701,2585k+Non-prefixed global variable
#118Masteriyo LMS – LMS Course Builder, Quizzes & Certificates231971,7485k+Non-prefixed global variable
#119Link Whisper Free233,8825,30330k+Text Domain Mismatch
#120MailPoet – Newsletters, Email Marketing, and Automation23858711500k+Exception output is not escaped
#121MasterStudy LMS WordPress Plugin – for Online Courses and Education231,4194,87510k+Non-prefixed global variable
#122MaxButtons – Create buttons2365540970k+Output is not escaped
#123Media Library Assistant231,1443,94370k+Nonce verification recommended
#124MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO234885802k+Missing nonce verification
#125Next Active Directory Integration236832842k+Exception output is not escaped
#126NitroPack – Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization23315631100k+Output is not escaped
#127Patchstack – WordPress & Plugins Security2310748940k+Missing nonce verification
#128Postie2340726110k+Output is not escaped
#129PowerPress Podcasting plugin by Blubrry234,8072,39420k+Output is not escaped
#130Pricing Table by Supsystic231,29944710k+Non Singular String Literal Domain
#131Product Watermark for WooCommerce236964572k+Output is not escaped
#132Real 3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder238561,36510k+Non-prefixed global variable
#133Robo Gallery – Photo & Image Slider231,29153040k+Output is not escaped
#134Local Google Analytics for WordPress – caches external requests235511993k+Output is not escaped
#135Slider Hero with Video Background, Animation231,5651,2533k+Text Domain Mismatch
#136Smart Slider 323261268800k+Non-prefixed global variable
#137SiteOrigin Widgets Bundle23607455400k+Output is not escaped
#138Strong Testimonials2319239390k+Nonce verification recommended
#139The Events Calendar233,5123,848700k+Text Domain Mismatch
#140Travelpayouts237691106k+Output is not escaped
#141UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP236952,43420k+Non-prefixed hook name
#142Cart PDF for WooCommerce235311721k+Exception output is not escaped
#143WHMCS Bridge232474724k+Nonce verification recommended
#144Worth The Read238731383k+Text Domain Mismatch
#145WP BackItUp Community Edition232579896k+Non-prefixed global variable
#146Clone2324426240k+Output is not escaped
#147WP Compress – Instant Performance & Speed Optimization233,0532,38410k+Non Singular String Literal Domain
#148WP Editor2350233520k+Unsafe printing function
#149WP Migrate Lite – Migration Made Easy23368254200k+Exception output is not escaped
#150Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning231,11820240k+Missing Translators Comment