PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_is_writeable

file system operations is writeable

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1Intercom060716k+Non-prefixed function
#2Live Shopping & Shoppable Videos For WooCommerce079174400Non-prefixed global variable
#3Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more1545166500k+Database parameter is not escaped
#4RestroPress – Online Food Ordering System175353,2111k+Non-prefixed global variable
#5Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution181,229923100k+Exception output is not escaped
#6Matomo Analytics – Powerful, Privacy-First Insights for WordPress191,993892100k+Exception output is not escaped
#7SendPress Newsletters192,2931,4221k+Output is not escaped
#8Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More202,8791,9791m+Non-prefixed global variable
#9MAS Videos205191,6931k+Non-prefixed global variable
#10Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non-prefixed global variable
#11Powered Cache – Caching and Optimization for WordPress – Easily Improve PageSpeed & Web Vitals Score201472313k+Exception output is not escaped
#12Captcha Them All213003235k+Output is not escaped
#13FileOrganizer – WordPress File Manager21549261200k+unlink unlink
#14Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction211,9945,33110k+Non-prefixed hook name
#15SeatReg213501,842300Missing nonce verification
#16Simple Job Board216351,37610k+Non-prefixed global variable
#17UPC/EAN/GTIN Barcode Generator/Importer21776311500Exception output is not escaped
#18Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms2249329510k+Text Domain Mismatch
#19Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8541,26940k+Text Domain Mismatch
#20easyReservations225,3072,480700Text Domain Mismatch
#21File Manager Pro – Filester22584411100k+Request data is not unslashed
#22WooCommerce221,3436,2107m+Non-prefixed global variable
#23File Manager227405201m+Unsafe printing function
#24Houzez Property Feed231,4161,5851k+Text Domain Mismatch
#25Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN233,42887770k+Text Domain Mismatch
#26InfiniteWP Client232,3791,844200k+Exception output is not escaped
#27NitroPack – Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization2329364590k+Non-prefixed global variable
#28Strong Testimonials2320140780k+Nonce verification recommended
#29Ultimate Fields23371458500Alternative PHP tag found
#30UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP236992,44120k+Non-prefixed hook name
#31WP BackItUp Community Edition232579896k+Non-prefixed global variable
#32WP Migrate Lite – Migration Made Easy23371257200k+Exception output is not escaped
#33WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups231,5801,786100k+Non-prefixed global variable
#34YITH WooCommerce Affiliates235521,5276k+Non-prefixed global variable
#35Advanced Contact form 7 DB247651,96170k+Non-prefixed global variable
#36Backuply – Backup, Restore, Migrate and Clone24729553600k+Non-prefixed global variable
#37BSK PDF Manager241,5796257k+Text Domain Mismatch
#38rtMedia for WordPress, BuddyPress and bbPress242932477k+Non-prefixed constant
#39Import and export users and customers241,04836070k+Unsafe printing function
#40Limit Attempts by BestWebSoft – WordPress Anti-Bot and Security Plugin for Login and Forms245635484k+Text Domain Mismatch
#41Stripe Payment Forms by WP Simple Pay – Accept Credit Card Payments + Subscriptions with Stripe246346528k+Exception output is not escaped
#42Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress242,5822,131100k+Output is not escaped
#43AdRotate Banner Manager251,35584320k+Unsafe printing function
#44Leaky Paywall25234777600Nonce verification recommended
#45VikAppointments Services Booking Calendar259,7625,211500Output is not escaped
#46VikBooking Hotel Booking Engine & PMS2513,2648,3238k+Output is not escaped
#47VikRentCar Car Rental Management System255,5375,0484k+Non-prefixed global variable
#48VikRentItems Flexible Rental Management System254,7634,642600Non-prefixed global variable
#49VikRestaurants Table Reservations and Take-Away2511,6444,932600Output is not escaped
#50PDF Ink Lite – Free PDF Watermark & Password Protection252075942k+Non-prefixed global variable