PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_readfile

file system operations readfile

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#51Seraphinite Accelerator2259525550k+Output is not escaped
#52Swift Performance Lite222,3461,3256k+Text Domain Mismatch
#5310Web Booster – Website speed optimization, Cache & Page Speed optimizer2250259970k+Non-prefixed global variable
#54Theme Editor2279868550k+Output is not escaped
#55Unlimited Elements Blocks Library227081,822400Non-prefixed global variable
#56RapidLoad AI – Optimize Web Vitals Automatically2281840700Nonce verification recommended
#57UpStream: a Project Management Plugin for WordPress22683703600Non-prefixed global variable
#58Paysera Payment Gateway for WooCommerce221,8701987k+Exception output is not escaped
#59File Manager227405201m+Unsafe printing function
#60WP Super Minify • Minify, Compress and Cache HTML, CSS & JavaScript221642578k+Non-prefixed constant
#61WP-WebAuthn229573962k+Exception output is not escaped
#62Frontend Admin by DynamiApps235,9463,2319k+Text Domain Mismatch
#63Ad Inserter – Ad Manager & AdSense Ads234,267812300k+Output is not escaped
#64AR for WordPress23151499400Non-prefixed global variable
#65CLUEVO LMS, E-Learning Platform231,8431,176400Text Domain Mismatch
#66Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe239,39626,6801k+Non-prefixed global variable
#67EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder233561,5482k+Non-prefixed global variable
#68Front End PM239782,2644k+Non-prefixed global variable
#69Tracking and Consent Manager – WP Full Picture231,2803,2233k+Non-prefixed global variable
#70Groundhogg — CRM, Newsletters, and Marketing Automation231439192k+Non-prefixed global variable
#71Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation2399240030k+Text Domain Mismatch
#72Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More231,8402,3102k+Non-prefixed global variable
#73Gutenberg23643348300k+Missing direct file access protection
#74Houzez Property Feed231,4161,5851k+Text Domain Mismatch
#75InfiniteWP Client232,2801,811200k+Exception output is not escaped
#76Import WP – Export and Import CSV and XML files to WordPress235793244k+Exception output is not escaped
#77Kadence Blocks — Page Builder Toolkit for Gutenberg Editor23552,127600k+Non-prefixed global variable
#78Masteriyo LMS – LMS Course Builder, Quizzes & Certificates231882,1235k+Non-prefixed global variable
#79Locatoraid Store Locator233186451k+Non-prefixed global variable
#80MailPoet – Newsletters, Email Marketing, and Automation23956721500k+Exception output is not escaped
#81Media Library File Download236151,2861k+Non-prefixed global variable
#82Media Library Assistant231,1303,81370k+Nonce verification recommended
#83Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery232,1541,027300k+Text Domain Mismatch
#84Photo Gallery by 10Web – Mobile-Friendly Image Gallery234,1571,553100k+Output is not escaped
#85Seraphinite Post .DOCX Source231,156110900Output is not escaped
#86Local Google Analytics for WordPress – caches external requests235511993k+Output is not escaped
#87Slider by 10Web – Responsive Image Slider235,81497610k+Output is not escaped
#88Strong Testimonials2319940290k+Nonce verification recommended
#89Unlimited Elements For Elementor237112,101300k+Non-prefixed global variable
#90WP BackItUp Community Edition232579896k+Non-prefixed global variable
#91WP Editor2350233520k+Unsafe printing function
#92WP Free SSL237351,3451k+Non-prefixed global variable
#93WP-Lister Lite for Amazon233,0614,177800Output is not escaped
#94FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce237982,19320k+SQL query is not prepared
#95WP Mega Menu239927928k+Non-prefixed global variable
#96WP Migrate Lite – Migration Made Easy23371257200k+Exception output is not escaped
#97WP STAGING – WordPress Backups, Restore, Migration & Clone231,5231,670100k+Non-prefixed global variable
#98Yatra – Travel Booking & Tour Operator Software232,2424,047600Non-prefixed global variable
#99A2 Optimized WP – Turbocharge and secure your WordPress site2427123160k+Missing Arg Domain
#100Advanced Contact form 7 DB247651,96170k+Non-prefixed global variable