PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_readfile

file system operations readfile

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#151Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation241,2113,15230k+Non-prefixed global variable
#152Advanced WordPress Reset – Debug, Recover & Reset WP2547546420k+Output is not escaped
#153AIO Forms – Craft Complex Forms Easily25189418700Mixed line endings
#154Appointment Booking Calendar253271,0701k+Non-prefixed global variable
#155Appointment Hour Booking – Booking Calendar252611,25410k+Non-prefixed global variable
#156ATUM WooCommerce Inventory Management and Stock Tracking252,6381,30410k+Non Singular String Literal Domain
#157Beaver Builder Page Builder – Drag and Drop Website Builder254,4631,819100k+Text Domain Mismatch
#158Booking Package251,7003,97710k+Missing nonce verification
#159BuddyPress Docs252844217k+Nonce verification recommended
#160Colissimo shipping methods for WooCommerce251,75555710k+Text Domain Mismatch
#161Contact Form Email254098989k+Non-prefixed global variable
#162CP Contact Form with PayPal25466936800Unsafe printing function
#163Smash Balloon Social Post Feed – Simple Social Feeds for WordPress25554982200k+Output is not escaped
#164Docket Cache – Object Cache Accelerator2533348120k+Output is not escaped
#165FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler253194667k+Non-prefixed global variable
#166GD Rating System251,5111,0431k+Output is not escaped
#167GD Security Headers254075211k+Output is not escaped
#168Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation2578931330k+Text Domain Mismatch
#169Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More251,7862,2202k+Non-prefixed global variable
#170Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews256451,5851k+Non-prefixed global variable
#171All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements2535259740k+Non-prefixed global variable
#172PDF Importer for WPForms25332329400Non-prefixed global variable
#173BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript251985013k+Non-prefixed global variable
#174Secure Copy Content Protection and Content Locking2595879920k+Output is not escaped
#175SEO Repair Kit – Meta Manager, Schema Manager, SEO Content Monitoring, GSC Integration, Keyword & Rank Tracking251969022k+Direct Query
#176TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder257051,58710k+Non-prefixed global variable
#177Toocheke Companion254091,1131k+Non-prefixed global variable
#178Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin251192,7002k+Non-prefixed global variable
#179Spectra Gutenberg Blocks – Website Builder for the Block Editor252533,2271m+Non-prefixed global variable
#180VikAppointments Services Booking Calendar259,7535,207500Output is not escaped
#181VikBooking Hotel Booking Engine & PMS2513,2328,3128k+Output is not escaped
#182PDF Builder for WooCommerce. Create invoices,packing slips and more253725032k+Non-prefixed global variable
#183Super Page Cache – Cloudflare Cache, Page Speed & Core Web Vitals2513735360k+Input is not sanitized
#184WP-DownloadManager256075083k+Unsafe printing function
#185WP Encryption – No.1 HTTPS plugin & One Click Free SSL Cert, HTTPS Redirect, Security257271,55450k+Non-prefixed global variable
#186Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF2515811860k+Non-prefixed global variable
#187SlimStat Analytics251,17787070k+Exception output is not escaped
#188Smush – Image Optimization, Compression, Lazy Load, WebP & CDN252525661m+Non-prefixed hook name
#189Wp Social Login and Register Social Counter258073890k+Non-prefixed global variable
#190WP Statistics – Simple, privacy-friendly Google Analytics alternative256102,465600k+Non-prefixed global variable
#191WP Time Slots Booking Form254391,1371k+Non-prefixed global variable
#192WPvivid — Backup, Migration & Staging258991,461900k+Non-prefixed namespace
#193Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty26113671400k+Non-prefixed global variable
#194ezCache2612726910k+Direct Query
#195MakeStories (for Google Web Stories)26117416600Nonce verification recommended
#196User Avatar261041734k+Non-prefixed constant
#197Faktur Pro for WooCommerce264162181k+Text Domain Mismatch
#198GSpeech TTS – WordPress Text To Speech Plugin278423323k+Output is not escaped
#199Simple Download Monitor2721827320k+Output is not escaped
#200Transbank Webpay2719821110k+Non-prefixed global variable