PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_mkdir

file system operations mkdir

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#201Custom CSS247036571k+Output is not escaped
#202WP Customer Area243,30694110k+Text Domain Mismatch
#203Customer Reviews for WooCommerce242,2022,44580k+Output is not escaped
#204Defender Security – Malware Scanner, Login Security & Firewall2454759480k+Non-prefixed namespace
#205Deployer for Git245411,336500Non-prefixed global variable
#206Digital License Manager24295670800Non-prefixed hook name
#207Doubly – Cross Domain Copy Paste for WordPress242525510k+Output is not escaped
#208Easy Form Builder by WhiteStudio — Drag & Drop Form Builder241943811k+Nonce verification recommended
#209eCommerce Product Catalog Plugin for WordPress246213,1777k+Non-prefixed function
#210EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents247111,588100k+Output is not escaped
#211Enable Media Replace24212276600k+Output is not escaped
#212Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns24120684200k+Non-prefixed global variable
#213Export WordPress Pages to Static HTML & PDF — Static Site Export245093044k+Text Domain Mismatch
#214Etsy Integration For WooCommerce241,2464,643900Non-prefixed global variable
#215F12 Profiler24282451500Direct Query
#216Fast Velocity Minify2428225640k+Unsafe printing function
#217Featured Post with thumbnail24158122400Output is not escaped
#218Fix Alt Text245443461k+Non Singular String Literal Domain
#219FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution2419375380k+Direct Query
#220Formidable PRO2PDF242184771k+Non-prefixed global variable
#221Fuse Social Floating Sidebar241,8381,57810k+Non-prefixed global variable
#222FV Player 8243231,3831k+Non-prefixed function
#223Photo Gallery – Responsive Image Galleries by Supsystic242409120k+Text Domain Mismatch
#224Assets manager, dequeue scripts, dequeue styles for WordPress245922552k+Output is not escaped
#225Simple Calendar – Google Calendar Plugin242,05359250k+Missing direct file access protection
#226Easy Google Maps241,76438920k+Non Singular String Literal Domain
#227Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN243,41086670k+Text Domain Mismatch
#228Import from YML2497306400Non-prefixed global variable
#229Infinite Uploads – Offload Media and Video to Cloud Storage24586722800Direct Query
#230Social Slider Feed – Social Media Feed & Gallery Widgets2492970720k+Non-prefixed global variable
#231InstaWP Connect – 1-click WP Staging & Migration2425381140k+Non-prefixed global variable
#232Dynamics 365 Integration24383166600Output is not escaped
#233Koko Analytics – Privacy-Friendly WordPress Analytics2416639560k+Short PHP open tag found
#234LearnPress – Backup & Migration Tool243854695k+Output is not escaped
#235MailerPress – Newsletter, email marketing & AI automation248053,9311k+Direct Query
#236Mailjet Email Marketing2443520610k+Unsafe printing function
#237Mang Board WP241,2134,7209k+Non-prefixed global variable
#238Media Library Folders2488980710k+Text Domain Mismatch
#239Ninja Forms – The Contact Form Builder That Grows With You247491,533600k+Nonce verification recommended
#240NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar2426740440k+Non-prefixed hook name
#241Opt-Out for Google Analytics (DSGVO / GDPR)242901,9783k+Non-prefixed global variable
#242Page Builder: Pagelayer – Drag and Drop website builder24769556400k+Output is not escaped
#243Participants Database249508947k+SQL query is not prepared
#244PDF Generator for WordPress Elementor245132711k+Exception output is not escaped
#245PeproDev Ultimate Invoice243792344k+Output is not escaped
#246PixelYourSite – Your smart PIXEL (TAG) & API Manager241,1762,416500k+Non-prefixed namespace
#247Post Status Notifier Lite24984451700Missing direct file access protection
#248Product Catalog Simple241,5551,9821k+Output is not escaped
#249Premmerce Product Filter for WooCommerce248171,4862k+Non-prefixed global variable
#250reGenerate Thumbnails Advanced2422012270k+Unsafe printing function