WordPress.WP.AlternativeFunctions.file_system_operations_pfsockopen
file system operations pfsockopen
The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.
Why It Shows Up
Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.
Why It Matters
WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.
How to Fix
- Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
- Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
- Never write PHP code from user input or remote responses.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1 | Pix por Piggly (para Woocommerce) | 20 | 547 | 195 | 4k+ | Exception output is not escaped | ||
| #2 | Buckaroo Woocommerce Payments Plugin | 21 | 584 | 326 | 2k+ | Exception output is not escaped | ||
| #3 | Data Tables Generator by Supsystic | 22 | 158 | 152 | 10k+ | Exception output is not escaped | ||
| #4 | Heureka | 22 | 557 | 254 | 400 | Exception output is not escaped | ||
| #5 | Smart Popup by Supsystic | 22 | 3,172 | 503 | 10k+ | Non Singular String Literal Domain | ||
| #6 | YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports | 22 | 654 | 435 | 10k+ | Exception output is not escaped | ||
| #7 | Next Active Directory Integration | 23 | 683 | 284 | 2k+ | Exception output is not escaped | ||
| #8 | Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces | 24 | 2,317 | 3,375 | 10k+ | slow db query meta key | ||
| #9 | Photo Gallery – Responsive Image Galleries by Supsystic | 24 | 240 | 91 | 20k+ | Text Domain Mismatch | ||
| #10 | Simple Calendar – Google Calendar Plugin | 24 | 2,053 | 592 | 50k+ | Missing direct file access protection | ||
| #11 | EU VAT Assistant for WooCommerce | 24 | 1,742 | 495 | 5k+ | Non Singular String Literal Domain | ||
| #12 | DecaLog | 25 | 943 | 236 | 1k+ | Exception output is not escaped | ||
| #13 | Site Kit by Google – Analytics, Search Console, AdSense, Speed | 25 | 1,304 | 242 | 5m+ | Missing direct file access protection | ||
| #14 | Media Cloud Sync | 25 | 1,095 | 274 | 1k+ | Exception output is not escaped |