PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_mkdir

file system operations mkdir

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#51Paysera Payment Gateway for WooCommerce211,8661957k+Exception output is not escaped
#52Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools217863,39530k+Non-prefixed global variable
#53Wordfence Security – Firewall, Malware Scan, and Login Security211,5922,9735m+Output is not escaped
#54WP Compress – Instant Performance & Speed Optimization213,3633,27410k+Non Singular String Literal Domain
#55WP-Lister Lite for eBay216,6975,1292k+Output is not escaped
#56WP phpMyAdmin214,5286,43550k+Missing Arg Domain
#57wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin211,8111,43270k+Output is not escaped
#58Premium Packages – Sell Digital Products Securely212,7652,4443k+Output is not escaped
#59Frontend Admin by DynamiApps225,9223,20810k+Text Domain Mismatch
#60Booking for Appointments and Events Calendar – Amelia221,48948090k+Exception output is not escaped
#61ANAC XML Bandi di Gara22294244600Output is not escaped
#62Backup Bolt225801,313800Non-prefixed global variable
#63BuddyPress225839,008100k+Non-prefixed function
#64Better WordPress Minify224124848k+Non Singular String Literal Domain
#65Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms2249329510k+Text Domain Mismatch
#66Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8581,27050k+Text Domain Mismatch
#67Code Profiler – WordPress Performance Profiling and Debugging Made Easy222654008k+Non-prefixed global variable
#68Accept PayPal Payments using Contact Form 722359127600Text Domain Mismatch
#69RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login223,6545,0618k+Non-prefixed global variable
#70WP Customer Area223,30894110k+Text Domain Mismatch
#71Data Tables Generator by Supsystic2215715010k+Exception output is not escaped
#72DirectoryPress – Business Directory And Classified Ad Listing224,7872,795800Text Domain Mismatch
#73Download Manager222,2841,335100k+Output is not escaped
#74Dynamic QR Code – generator222382086k+Missing direct file access protection
#75E2Pdf – Export Pdf Tool for WordPress221,07583610k+Unsafe printing function
#76Events Manager – Calendar, Bookings, Tickets, and more!224,7135,64770k+Output is not escaped
#77File Manager Pro – Filester22565391100k+Request data is not unslashed
#78Finale Lite – Sales Countdown Timer & Discount for WooCommerce221,0314514k+Output is not escaped
#79Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder22409236700k+Text Domain Mismatch
#80Heureka22557254400Exception output is not escaped
#81Insert or Embed Articulate Content into WordPress226591,4372k+Non-prefixed global variable
#82The Innovative Form Builder – IvyForms22713250400Exception output is not escaped
#83InfiniteWP Client222,2861,812200k+Exception output is not escaped
#84Import WP – Export and Import CSV and XML files to WordPress225803304k+Exception output is not escaped
#85Jim Soft Swiss QR Invoice22262392400Non-prefixed global variable
#86MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.222,6192,45310k+Output is not escaped
#87Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider22207323500k+Non-prefixed global variable
#88Moloni229023562k+Missing Arg Domain
#89myCred Toolkit with AI Assistant – Scale Your Loyalty & Gamification Rewards With Integrations221,5881,172400Output is not escaped
#90NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall221,2662,059100k+Non-prefixed global variable
#91NinjaScanner – Virus & Malware scan2259655130k+Non-prefixed global variable
#92PDF Builder for WPForms22321266900SQL query is not prepared
#93Smart Popup by Supsystic223,17250310k+Non Singular String Literal Domain
#94Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App221,5812,326300k+Non-prefixed global variable
#95Prime Mover – Migrate WordPress Website & Backups221,3261,60010k+Non-prefixed global variable
#96Product Catalog Feed by PixelYourSite225813578k+Output is not escaped
#97PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP229844075k+Unsafe printing function
#98RabbitLoader Cache: Optimize your Website for Speed222411632k+Output is not escaped
#99Seraphinite Accelerator2259425550k+Output is not escaped
#100ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF221,044799300k+Non-prefixed global variable