PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_mkdir

file system operations mkdir

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsUpdatedTop Issue
#1BulletProof Security05,0484,94920k+Output Not Escaped
#2Intercom060716k+Non Prefixed Function Found
#3Plugin Check (PCP)012813210k+Exception Not Escaped
#4Themify Builder95,1952,0965k+Text Domain Mismatch
#5JetBackup – Backup, Restore & Migrate101,559145100k+Exception Not Escaped
#6AnyComment174454495k+Output Not Escaped
#7Shopping Cart & eCommerce Store185,45917,2984k+Non Prefixed Variable Found
#8WP Import Export Lite1873897940k+Non Prefixed Variable Found
#9Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution191,218901100k+Exception Not Escaped
#10Matomo Analytics – Powerful, Privacy-First Insights for WordPress191,909878100k+Exception Not Escaped
#11Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization191,2952,6799k+Output Not Escaped
#12Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)195413853m+Missing Translators Comment
#13BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot205081,40630k+Non Prefixed Variable Found
#14Brizy – Page Builder2058972070k+Output Not Escaped
#15Filter Everything — WordPress & WooCommerce Filters2056873050k+Output Not Escaped
#16Link Library201,9411,39710k+Unsafe Printing Function
#17Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non Prefixed Variable Found
#18Pix por Piggly (para Woocommerce)205471954k+Exception Not Escaped
#19Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF20557541100k+Output Not Escaped
#20Razorpay for WooCommerce20974855100k+Non Prefixed Function Found
#21WPJAM Basic203283564k+Output Not Escaped
#22Store Locator WordPress212,3721,57210k+Text Domain Mismatch
#23Backup Migration219811,09380k+Non Prefixed Variable Found
#24Captcha Them All213003236k+Output Not Escaped
#25Smart Grid-Layout Design for Contact Form 7211,12673410k+Output Not Escaped
#26Comet Cache2185724520k+Output Not Escaped
#27Free Downloads WooCommerce214303594k+Output Not Escaped
#28Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More212,5721,2771m+Output Not Escaped
#29EventPrime – Events Calendar, Bookings and Tickets218724,2977k+Non Prefixed Variable Found
#30FileOrganizer – WordPress File Manager21536241200k+unlink unlink
#31Modular DS: Monitor, update, and backup multiple websites211618140k+Exception Not Escaped
#32Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4693,33310k+Non Prefixed Variable Found
#33Packeta218023338k+Exception Not Escaped
#34User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor216961,48350k+Recommended
#35Smart Forms – when you need more than just a contact form217765745k+Output Not Escaped
#36WebP Express21160427300k+Non Prefixed Variable Found
#37Wise Chat214705065k+Output Not Escaped
#38Paysera Payment Gateway for WooCommerce211,8661957k+Exception Not Escaped
#39Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools217863,39530k+Non Prefixed Variable Found
#40Wordfence Security – Firewall, Malware Scan, and Login Security211,5922,9735m+Output Not Escaped
#41WP phpMyAdmin214,5286,43550k+Missing Arg Domain
#42wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin211,3541,14070k+Output Not Escaped
#43Frontend Admin by DynamiApps225,9223,20810k+Text Domain Mismatch
#44Booking for Appointments and Events Calendar – Amelia221,48948090k+Exception Not Escaped
#45BuddyPress225839,008100k+Non Prefixed Function Found
#46Better WordPress Minify224124848k+Non Singular String Literal Domain
#47Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms2249329510k+Text Domain Mismatch
#48Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8581,27050k+Text Domain Mismatch
#49Code Profiler – WordPress Performance Profiling and Debugging Made Easy222654008k+Non Prefixed Variable Found
#50RegistrationMagic – User Registration Forms Plugin223,6545,0628k+Non Prefixed Variable Found