WordPress.WP.AlternativeFunctions.file_system_operations_readfile
file system operations readfile
The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.
Why It Shows Up
Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.
Why It Matters
WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.
How to Fix
- Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
- Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
- Never write PHP code from user input or remote responses.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1 | Themify Builder | 9 | 5,329 | 2,171 | 5k+ | Text Domain Mismatch | ||
| #2 | 404 Solution | 15 | 531 | 1,507 | 10k+ | Non-prefixed class | ||
| #3 | AnyComment | 17 | 445 | 449 | 5k+ | Output is not escaped | ||
| #4 | Efí Bank | 17 | 886 | 553 | 400 | Exception output is not escaped | ||
| #5 | Administrator Z | 18 | 2,061 | 799 | 400 | Output is not escaped | ||
| #6 | Shopping Cart & eCommerce Store | 18 | 5,373 | 17,466 | 3k+ | Non-prefixed global variable | ||
| #7 | Matomo Analytics – Powerful, Privacy-First Insights for WordPress | 19 | 1,900 | 877 | 100k+ | Exception output is not escaped | ||
| #8 | Membership Plugin – Kadence Memberships | 19 | 5,083 | 2,982 | 9k+ | Text Domain Mismatch | ||
| #9 | WP Import Export Lite | 19 | 737 | 979 | 40k+ | Non-prefixed global variable | ||
| #10 | Broadstreet | 20 | 434 | 273 | 700 | Output is not escaped | ||
| #11 | GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership | 20 | 1,832 | 720 | 700 | Non Singular String Literal Domain | ||
| #12 | Link Library | 20 | 1,941 | 1,392 | 10k+ | Unsafe printing function | ||
| #13 | MBE eShip | 20 | 527 | 740 | 1k+ | Non-prefixed global variable | ||
| #14 | Pix por Piggly (para Woocommerce) | 20 | 547 | 195 | 4k+ | Exception output is not escaped | ||
| #15 | Powered Cache – Caching and Optimization for WordPress – Easily Improve PageSpeed & Web Vitals Score | 20 | 147 | 231 | 3k+ | Exception output is not escaped | ||
| #16 | WP Compress – Instant Performance & Speed Optimization | 20 | 4,088 | 3,519 | 10k+ | Non Singular String Literal Domain | ||
| #17 | WP Minify Fix | 20 | 306 | 380 | 800 | Output is not escaped | ||
| #18 | Backup Migration | 21 | 999 | 1,081 | 80k+ | Non-prefixed global variable | ||
| #19 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots | 21 | 1,614 | 2,030 | 10k+ | Direct Query | ||
| #20 | DELUCKS SEO | 21 | 362 | 1,171 | 400 | Missing nonce verification | ||
| #21 | Free Downloads WooCommerce | 21 | 430 | 359 | 4k+ | Output is not escaped | ||
| #22 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More | 21 | 2,572 | 1,277 | 1m+ | Output is not escaped | ||
| #23 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More | 21 | 52 | 2,118 | 300k+ | Non-prefixed global variable | ||
| #24 | Mergado Pack | 21 | 2,323 | 588 | 700 | Output is not escaped | ||
| #25 | Mooberry Book Manager | 21 | 1,040 | 399 | 1k+ | Text Domain Mismatch | ||
| #26 | SeatReg | 21 | 312 | 1,637 | 400 | Missing nonce verification | ||
| #27 | Smart Forms – when you need more than just a contact form | 21 | 776 | 574 | 5k+ | Output is not escaped | ||
| #28 | Buckaroo Woocommerce Payments Plugin | 21 | 638 | 321 | 2k+ | Exception output is not escaped | ||
| #29 | Paysera Payment Gateway for WooCommerce | 21 | 1,868 | 196 | 7k+ | Exception output is not escaped | ||
| #30 | Wordfence Security – Firewall, Malware Scan, and Login Security | 21 | 1,818 | 3,236 | 5m+ | Output is not escaped | ||
| #31 | WP-Lister Lite for eBay | 21 | 6,701 | 5,132 | 2k+ | Output is not escaped | ||
| #32 | WP phpMyAdmin | 21 | 4,528 | 6,435 | 40k+ | Missing Arg Domain | ||
| #33 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin | 21 | 1,834 | 1,530 | 70k+ | Output is not escaped | ||
| #34 | Backup Bolt | 22 | 580 | 1,313 | 800 | Non-prefixed global variable | ||
| #35 | Better WordPress Minify | 22 | 412 | 484 | 7k+ | Non Singular String Literal Domain | ||
| #36 | Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer | 22 | 2,854 | 1,269 | 50k+ | Text Domain Mismatch | ||
| #37 | RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login | 22 | 3,652 | 5,145 | 8k+ | Non-prefixed global variable | ||
| #38 | Download Manager | 22 | 2,513 | 1,459 | 100k+ | Output is not escaped | ||
| #39 | Ebook Store | 22 | 410 | 1,054 | 700 | Non-prefixed global variable | ||
| #40 | FireBox Popups – Increase Sales and Grow Your Email List | 22 | 157 | 826 | 7k+ | Non-prefixed global variable | ||
| #41 | Csomagpontok és Címkék WooCommerce-hez | 22 | 2,002 | 769 | 7k+ | Text Domain Mismatch | ||
| #42 | JCH Optimize | 22 | 1,145 | 136 | 4k+ | Output is not escaped | ||
| #43 | Jim Soft Swiss QR Invoice | 22 | 264 | 392 | 400 | Non-prefixed global variable | ||
| #44 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | 22 | 2,433 | 3,594 | 70k+ | Non-prefixed global variable | ||
| #45 | MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. | 22 | 2,625 | 2,458 | 10k+ | Output is not escaped | ||
| #46 | MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution | 22 | 1,131 | 1,845 | 700 | Non-prefixed global variable | ||
| #47 | Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization | 22 | 1,359 | 2,800 | 8k+ | Output is not escaped | ||
| #48 | MultiParcels Shipping For WooCommerce | 22 | 242 | 422 | 4k+ | Request data is not unslashed | ||
| #49 | Newsletters | 22 | 2,977 | 2,261 | 2k+ | Text Domain Mismatch | ||
| #50 | PDF Builder for WPForms | 22 | 321 | 268 | 900 | SQL query is not prepared |
