PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_mkdir

file system operations mkdir

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1BulletProof Security05,0484,94920k+Output is not escaped
#2Intercom060716k+Non-prefixed function
#3Live Shopping & Shoppable Videos For WooCommerce079174400Non-prefixed global variable
#4Plugin Check (PCP)012813210k+Exception output is not escaped
#5Themify Builder95,3042,1365k+Text Domain Mismatch
#6JetBackup – Backup, Restore & Migrate101,563149200k+Exception output is not escaped
#7AnyComment174454495k+Output is not escaped
#8Efí Bank17886553400Exception output is not escaped
#9Realtyna Organic IDX plugin + WPL Real Estate189303,6362k+Non-prefixed global variable
#10Shopping Cart & eCommerce Store185,37317,4663k+Non-prefixed global variable
#11Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution191,218901100k+Exception output is not escaped
#12Matomo Analytics – Powerful, Privacy-First Insights for WordPress191,900877100k+Exception output is not escaped
#13Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)195363793m+Missing Translators Comment
#14WP Import Export Lite1973797940k+Non-prefixed global variable
#15WP Directory Kit191,5042,6382k+Non-prefixed global variable
#16WPJAM Basic193253464k+Output is not escaped
#17Brizy – Page Builder2058672670k+Output is not escaped
#18Broadstreet20434273700Output is not escaped
#19Link Library201,9421,39410k+Unsafe printing function
#20MBE eShip205277401k+Non-prefixed global variable
#21Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non-prefixed global variable
#22Pix por Piggly (para Woocommerce)205471954k+Exception output is not escaped
#23Powered Cache – Caching and Optimization for WordPress – Easily Improve PageSpeed & Web Vitals Score201472313k+Exception output is not escaped
#24Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF20556543100k+Output is not escaped
#25Razorpay for WooCommerce20975859100k+Non-prefixed function
#26Store Locator WordPress212,4941,62810k+Text Domain Mismatch
#27Backup Migration219811,09380k+Non-prefixed global variable
#28Kadence Security – Password, Two Factor Authentication, and Brute Force Protection211,060957700k+Missing Translators Comment
#29Captcha Them All213003235k+Output is not escaped
#30Comet Cache2185724520k+Output is not escaped
#31DELUCKS SEO213621,171400Missing nonce verification
#32Free Downloads WooCommerce214303594k+Output is not escaped
#33Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More212,5721,2771m+Output is not escaped
#34EventPrime – Events Calendar, Bookings and Tickets218734,3087k+Non-prefixed global variable
#35FileOrganizer – WordPress File Manager21536241200k+unlink unlink
#36Filter Everything — WordPress & WooCommerce Filters2164493350k+Non-prefixed global variable
#37Campaign Monitor for WordPress213864612k+Non-prefixed global variable
#38Mergado Pack212,323588700Output is not escaped
#39Modular DS: Monitor, update, and backup multiple websites211598240k+Exception output is not escaped
#40Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4783,33710k+Non-prefixed global variable
#41User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor217031,46340k+Missing Translators Comment
#42SeatReg213121,637400Missing nonce verification
#43Smart Forms – when you need more than just a contact form217765745k+Output is not escaped
#44Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin211,0642,97540k+Direct Query
#45UPC/EAN/GTIN Barcode Generator/Importer21776311500Exception output is not escaped
#46Buckaroo Woocommerce Payments Plugin216383212k+Exception output is not escaped
#47WebP Express21160427300k+Non-prefixed global variable
#48Wise Chat214705065k+Output is not escaped
#49Paysera Payment Gateway for WooCommerce211,8681967k+Exception output is not escaped
#50Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools217863,39730k+Non-prefixed global variable