PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_mkdir

file system operations mkdir

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#301CSS & JavaScript Toolbox2515561710k+Non-prefixed class
#302DecaLog259432361k+Exception output is not escaped
#303Disable Admin Notices – Hide Dashboard Notifications25465195100k+Output is not escaped
#304Docket Cache – Object Cache Accelerator2533348120k+Output is not escaped
#305F4 Post Tree255361,332500Non-prefixed global variable
#306FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler253194667k+Non-prefixed global variable
#307WP Fast Total Search – The Power of Indexed Search252092911k+Non-prefixed global variable
#308Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)25501,0431k+Non-prefixed global variable
#309Site Kit by Google – Analytics, Search Console, AdSense, Speed251,3042425m+Missing direct file access protection
#310Sitemap by BestWebSoft – WordPress XML Site Map Page Generator Plugin2560820720k+Text Domain Mismatch
#311Hardcore Google Fonts Localizer25331261900Text Domain Mismatch
#312Infinite Uploads – Offload Media and Video to Cloud Storage25579720800Direct Query
#313IP Locator25482211600Text Domain Mismatch
#314LWS Optimize – All-in-One Speed Booster & Cache Tools2543076420k+Non-prefixed global variable
#315MaxButtons – Create buttons2562640470k+Output is not escaped
#316Media Cloud Sync251,0952741k+Exception output is not escaped
#317MyFatoorah – WooCommerce25191893k+Output is not escaped
#318Nexter Extension – Security, Performance, Code Snippets & Site Toolkit2519871010k+Nonce verification recommended
#319NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar2525740040k+Non-prefixed hook name
#320PDF Importer for WPForms25332329400Non-prefixed global variable
#321PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin251,0841,2969k+Non-prefixed global variable
#322phpinfo() WP — Site Health, PHP Compatibility & Server Audit252767043k+Non-prefixed global variable
#323Piotnet Forms251873743k+Alternative PHP tag found
#324QuadMenu – Mega Menu252,12845510k+Output is not escaped
#325reSmush.it : The original free image compressor and optimizer plugin2515569100k+Output is not escaped
#326BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript251985013k+Non-prefixed global variable
#327SEO Repair Kit – Meta Manager, Schema Manager, SEO Content Monitoring, GSC Integration, Keyword & Rank Tracking251969022k+Direct Query
#328STAGGS – Product Configurator Toolkit256262,180400Non-prefixed global variable
#329Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator256481,0211k+Output is not escaped
#330SupportCandy – Helpdesk & Customer Support Ticket System254341,35710k+Direct Query
#331Tamara Checkout256012282k+Exception output is not escaped
#332Taskbuilder – Project Management & Task Management Tool With Kanban Board251274,332800Non-prefixed global variable
#333TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder257051,58710k+Non-prefixed global variable
#334Ultimate Blocks – 25+ Gutenberg Blocks for Block Editor256901,58150k+Non-prefixed global variable
#335Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP252981,010500Request data is not unslashed
#336VikAppointments Services Booking Calendar259,7535,207500Output is not escaped
#337VikBooking Hotel Booking Engine & PMS2513,2328,3128k+Output is not escaped
#338VikRentCar Car Rental Management System255,5375,0484k+Non-prefixed global variable
#339VikRestaurants Table Reservations and Take-Away2511,6444,932600Output is not escaped
#340PDF Builder for WooCommerce. Create invoices,packing slips and more253725032k+Non-prefixed global variable
#341Pay with Vipps and MobilePay for WooCommerce258465145k+Output is not escaped
#342Super Page Cache – Cloudflare Cache, Page Speed & Core Web Vitals2513735360k+Input is not sanitized
#343WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards251,4311,27010k+Output is not escaped
#344WP-DownloadManager256075083k+Unsafe printing function
#345WP Review Slider251,1862,2796k+Non-prefixed global variable
#346WP Go Maps – Google Map, OpenStreetMap, Leaflet Map254,9961,008300k+Unsafe printing function
#347WP Encryption – No.1 HTTPS plugin & One Click Free SSL Cert, HTTPS Redirect, Security257271,55450k+Non-prefixed global variable
#348SlimStat Analytics251,17787070k+Exception output is not escaped
#349Smush – Image Optimization, Compression, Lazy Load, WebP & CDN252525661m+Non-prefixed hook name
#350WP Super Cache258009891m+Output is not escaped