WordPress.WP.AlternativeFunctions.file_system_operations_mkdir
file system operations mkdir
The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.
Why It Shows Up
Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.
Why It Matters
WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.
How to Fix
- Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
- Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
- Never write PHP code from user input or remote responses.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #551 | Rollbar | 39 | 75 | 14 | 400 | Output is not escaped | ||
| #552 | Use Any Font | Custom Font Uploader | 39 | 36 | 55 | 200k+ | Request data is not unslashed | ||
| #553 | Visual Portfolio, Photo Gallery & Post Grid | 39 | 34 | 189 | 60k+ | Non-prefixed hook name | ||
| #554 | WP Performance Score Booster – Optimize Speed, Enable Cache & Page Preload | 39 | 59 | 27 | 10k+ | Unsafe printing function | ||
| #555 | Billingo Official for WooCommerce | 40 | 25 | 37 | 3k+ | Output is not escaped | ||
| #556 | Eventer | 40 | 61 | 55 | 1k+ | Output is not escaped | ||
| #557 | Salat Times | 40 | 235 | 20 | 500 | Output is not escaped | ||
| #558 | Search with Typesense | 40 | 81 | 122 | 700 | Non-prefixed global variable | ||
| #559 | Serviceform Pixel | 40 | 18 | 22 | 400 | Output is not escaped | ||
| #560 | Universal Honey Pot | 40 | 23 | 94 | 1k+ | Missing nonce verification | ||
| #561 | Heroic Favicon Generator | 41 | 104 | 7 | 6k+ | Output is not escaped | ||
| #562 | Highcompress Image Compressor | 41 | 106 | 69 | 600 | Text Domain Mismatch | ||
| #563 | MouseWheel Smooth Scroll | 41 | 104 | 7 | 100k+ | Text Domain Mismatch | ||
| #564 | Simple Cache | 41 | 33 | 59 | 1k+ | Input is not sanitized | ||
| #565 | Theme Duplicator | 41 | 14 | 31 | 400 | Nonce verification recommended | ||
| #566 | WooCommerce Colors | 41 | 63 | 28 | 10k+ | Output is not escaped | ||
| #567 | Post Types Order | 42 | 45 | 43 | 600k+ | wp function not compatible with requires wp | ||
| #568 | WP Child Theme Generator | 42 | 35 | 66 | 20k+ | Request data is not unslashed | ||
| #569 | Comment Image | 44 | 19 | 23 | 1k+ | Output is not escaped | ||
| #570 | Icons Font Loader – Load Web Fonts and Icon Libraries | 45 | 47 | 33 | 2k+ | Text Domain Mismatch | ||
| #571 | Official CleverReach® Plugin for WooCommerce | 46 | 37 | 98 | 400 | Non-prefixed global variable | ||
| #572 | Export Import Menus | 46 | 23 | 28 | 10k+ | Missing nonce verification | ||
| #573 | Tabby Checkout | 47 | 33 | 46 | 4k+ | Non-prefixed class | ||
| #574 | The Tribal Plugin | 47 | 43 | 62 | 700 | Non-prefixed function | ||
| #575 | Compress, Resize & Lazy Load Images – WPvivid Image Optimization | 47 | 107 | 58 | 10k+ | Missing direct file access protection | ||
| #576 | Ansar Import – One Click Starter Sites – for Elementor & Themes | 48 | 27 | 116 | 10k+ | Non-prefixed global variable | ||
| #577 | PDF Invoices & Packing Slips for WooCommerce – Challan | 49 | 56 | 151 | 4k+ | Non-prefixed global variable | ||
| #578 | IMGspider – 图片采集抓取插件 | 50 | 12 | 49 | 2k+ | Missing nonce verification | ||
| #579 | Formstack Online Forms | 52 | 39 | 20 | 1k+ | Output is not escaped | ||
| #580 | Elegant Custom Fonts | 53 | 15 | 17 | 3k+ | Output is not escaped | ||
| #581 | pretix widget | 53 | 25 | 39 | 400 | Non-prefixed global variable | ||
| #582 | Royal WordPress Backup, Restore & Migration Plugin – Backup WordPress Sites Safely | 53 | 34 | 90 | 20k+ | Database parameter is not escaped | ||
| #583 | FluentSnippets – High-Performance Code Snippets, Header & Footer Code, Custom CSS & PHP Code Manager | 56 | 31 | 27 | 50k+ | Nonce verification recommended | ||
| #584 | WP Table Builder – Drag & Drop Table Builder | 57 | 63 | 39 | 50k+ | Not Allowed | ||
| #585 | Nginx Cache | 58 | 12 | 8 | 10k+ | Unsafe printing function | ||
| #586 | Post/Page Import Export – Migrate Content with Custom Fields & Taxonomies | 61 | 12 | 27 | 400 | Input is not sanitized | ||
| #587 | Mantenimiento web | 63 | 49 | 15 | 20k+ | Text Domain Mismatch | ||
| #588 | Admin CSS MU | 64 | 30 | 582 | 10k+ | Non-prefixed global variable | ||
| #589 | QRCode | 65 | 21 | 39 | 400 | Non-prefixed constant | ||
| #590 | Debug Log Manager – Conveniently Monitor and Inspect Errors | 66 | 33 | 44 | 10k+ | Input is not validated | ||
| #591 | Really Simple CSV Importer | 66 | 38 | 8 | 40k+ | Output is not escaped | ||
| #592 | Desert Companion | 68 | 412 | 837 | 20k+ | Non-prefixed global variable | ||
| #593 | Nginx Helper | 71 | 47 | 60 | 200k+ | Non-prefixed global variable | ||
| #594 | Anchor Episodes Index (Spotify for Podcasters) | 75 | 32 | 3 | 1k+ | Text Domain Mismatch | ||
| #595 | Cache External Scripts | 76 | 21 | 4 | 900 | Output is not escaped | ||
| #596 | Table Of Contents Block | 77 | 15 | 8 | 10k+ | wp function not compatible with requires wp | ||
| #597 | Auto Featured Image (Auto Post Thumbnail) | 79 | 5 | 30 | 50k+ | Non-prefixed hook name | ||
| #598 | Custom Icons for Elementor | 80 | 6 | 25 | 10k+ | Non-prefixed global variable | ||
| #599 | Flipbox | 80 | 14 | 17 | 2k+ | wp function not compatible with requires wp | ||
| #600 | Countdown Block | 81 | 14 | 10 | 4k+ | wp function not compatible with requires wp |
