PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_is_writable

file system operations is writable

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#201Kognetiks Chatbot for WordPress246511,486600Non-prefixed global variable
#202Church Admin241,5544,207900Direct Query
#203CleanTalk Anti-Spam. Spam Firewall & Bot protection248181,092200k+Missing nonce verification
#204Complianz – GDPR/CCPA Cookie Consent244874031m+Missing Arg Domain
#205Contact Form by Supsystic241,9136336k+Non Singular String Literal Domain
#206WPBot – ChatBot Conversational Forms241,2541,2262k+Text Domain Mismatch
#207Custom CSS247036571k+Output is not escaped
#208Customer Reviews for WooCommerce242,2022,44580k+Output is not escaped
#209Defender Security – Malware Scanner, Login Security & Firewall2454759480k+Non-prefixed namespace
#210Doubly – Cross Domain Copy Paste for WordPress242525510k+Output is not escaped
#211Easy Form Builder by WhiteStudio — Drag & Drop Form Builder241943811k+Nonce verification recommended
#212Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress246521,49560k+Non-prefixed hook name
#213Enable Media Replace24212276600k+Output is not escaped
#214Event Tickets and Registration243,4094,21790k+Non-prefixed global variable
#215Export WordPress Pages to Static HTML & PDF — Static Site Export245093044k+Text Domain Mismatch
#216Etsy Integration For WooCommerce241,2464,643900Non-prefixed global variable
#217F12 Profiler24282451500Direct Query
#218Fast Velocity Minify2428225640k+Unsafe printing function
#219Football Pool241,0857331k+Output is not escaped
#220Force Sell for WooCommerce24697455600Text Domain Mismatch
#221Formidable PRO2PDF242184771k+Non-prefixed global variable
#222Fuse Social Floating Sidebar241,8381,57810k+Non-prefixed global variable
#223Photo Gallery – Responsive Image Galleries by Supsystic242409120k+Text Domain Mismatch
#224GD Mail Queue24502582700Output is not escaped
#225GG Woo Feed for WooCommerce Shopping Feed on Google and Other Channels244695921k+Non-prefixed global variable
#226Simple Calendar – Google Calendar Plugin242,05359250k+Missing direct file access protection
#227Easy Google Maps241,76438920k+Non Singular String Literal Domain
#228Grid/List View for WooCommerce241,1165462k+Output is not escaped
#229Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN243,41086670k+Text Domain Mismatch
#230Infinite Uploads – Offload Media and Video to Cloud Storage24586722800Direct Query
#231InstaWP Connect – 1-click WP Staging & Migration2425381140k+Non-prefixed global variable
#232Dynamics 365 Integration24383166600Output is not escaped
#233Koko Analytics – Privacy-Friendly WordPress Analytics2416639560k+Short PHP open tag found
#234LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes244141,17610k+Non-prefixed global variable
#235Load More Products for WooCommerce2473145920k+Text Domain Mismatch
#236MailerPress – Newsletter, email marketing & AI automation248053,9311k+Direct Query
#237Mang Board WP241,2134,7209k+Non-prefixed global variable
#238Min and Max Quantity for WooCommerce2460345920k+Text Domain Mismatch
#239My Agile Privacy® – CMP, Cookie Consent & Privacy Tools241,1706747k+Text Domain Mismatch
#240Newsletter – Send awesome emails from WordPress248982,219200k+Non-prefixed global variable
#241Pagination Styler for WooCommerce247994481k+Output is not escaped
#242Participants Database249508947k+SQL query is not prepared
#243PDF Generator for WordPress Elementor245132711k+Exception output is not escaped
#244PixelYourSite – Your smart PIXEL (TAG) & API Manager241,1762,416500k+Non-prefixed namespace
#245Post Status Notifier Lite24984451700Missing direct file access protection
#246Product Tabs Manager for WooCommerce246344822k+Text Domain Mismatch
#247Product Watermark for WooCommerce246854592k+Text Domain Mismatch
#248Products Compare for WooCommerce241,0226951k+Output is not escaped
#249reGenerate Thumbnails Advanced2422012270k+Unsafe printing function
#250PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes2442158310k+Missing Translators Comment