PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_is_writeable

file system operations is writeable

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1Intercom060716k+Non-prefixed function
#2Live Shopping & Shoppable Videos For WooCommerce079174400Non-prefixed global variable
#3Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more1545166500k+Database parameter is not escaped
#4RestroPress – Online Food Ordering System175243,1551k+Non-prefixed global variable
#5Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution191,218901100k+Exception output is not escaped
#6Matomo Analytics – Powerful, Privacy-First Insights for WordPress191,900877100k+Exception output is not escaped
#7SendPress Newsletters192,2931,4221k+Output is not escaped
#8Leaky Paywall20322789600Nonce verification recommended
#9MAS Videos205191,6931k+Non-prefixed global variable
#10Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non-prefixed global variable
#11Powered Cache – Caching and Optimization for WordPress – Easily Improve PageSpeed & Web Vitals Score201472313k+Exception output is not escaped
#12rtMedia for WordPress, BuddyPress and bbPress213636477k+Non-prefixed constant
#13Captcha Them All213003235k+Output is not escaped
#14Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More212,5721,2771m+Output is not escaped
#15FileOrganizer – WordPress File Manager21536241200k+unlink unlink
#16Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction211,9535,29710k+Non-prefixed hook name
#17SeatReg213121,637400Missing nonce verification
#18UPC/EAN/GTIN Barcode Generator/Importer21776311500Exception output is not escaped
#19WooCommerce211,3436,2127m+Non-prefixed global variable
#20Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms2249329510k+Text Domain Mismatch
#21Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8541,26950k+Text Domain Mismatch
#22easyReservations225,3072,480800Text Domain Mismatch
#23File Manager Pro – Filester22566391100k+Request data is not unslashed
#24Simple Job Board226341,35510k+Non-prefixed global variable
#25File Manager227405201m+Unsafe printing function
#26BSK PDF Manager231,5766257k+Text Domain Mismatch
#27Houzez Property Feed231,4161,5851k+Text Domain Mismatch
#28InfiniteWP Client232,2871,811200k+Exception output is not escaped
#29NitroPack – Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization2331163590k+Output is not escaped
#30Strong Testimonials2319940290k+Nonce verification recommended
#31Ultimate Fields23371458600Alternative PHP tag found
#32UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP236952,44020k+Non-prefixed hook name
#33WP BackItUp Community Edition232579896k+Non-prefixed global variable
#34WP Migrate Lite – Migration Made Easy23369255200k+Exception output is not escaped
#35WP STAGING – WordPress Backups, Restore, Migration & Clone231,5251,610100k+Non-prefixed global variable
#36YITH WooCommerce Affiliates235491,5276k+Non-prefixed global variable
#37Advanced Contact form 7 DB247651,96170k+Non-prefixed global variable
#38Backuply – Backup, Restore, Migrate and Clone24709555600k+Non-prefixed global variable
#39Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN243,40886670k+Text Domain Mismatch
#40Import and export users and customers241,04635770k+Unsafe printing function
#41Limit Attempts by BestWebSoft – WordPress Anti-Bot and Security Plugin for Login and Forms245635484k+Text Domain Mismatch
#42Slider Hero with Video Background, Animation24469043k+Non-prefixed hook name
#43Stripe Payment Forms by WP Simple Pay – Accept Credit Card Payments + Subscriptions with Stripe246346529k+Exception output is not escaped
#44PDF Ink Lite – Free PDF Watermark & Password Protection242265612k+Non-prefixed global variable
#45Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress242,5812,109100k+Output is not escaped
#46AdRotate Banner Manager251,35784620k+Unsafe printing function
#47All 404 Redirect to Homepage25140301200k+date date
#48CSS & JavaScript Toolbox2515561710k+Non-prefixed class
#49VikAppointments Services Booking Calendar259,7595,209500Output is not escaped
#50VikBooking Hotel Booking Engine & PMS2513,2518,3168k+Output is not escaped