PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_rmdir

file system operations rmdir

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1BulletProof Security05,0484,94920k+Output is not escaped
#2Intercom060716k+Non-prefixed function
#3Live Shopping & Shoppable Videos For WooCommerce078175400Non-prefixed global variable
#4Plugin Check (PCP)012813210k+Exception output is not escaped
#5Themify Builder95,2072,1255k+Text Domain Mismatch
#6JetBackup – Backup, Restore & Migrate101,563149200k+Exception output is not escaped
#7AnyComment174454495k+Output is not escaped
#8wpForo Forum174,0543,03320k+Unsafe printing function
#9WPtouch – Make your WordPress Website Mobile-Friendly171,46632550k+Text Domain Mismatch
#10Prime Slider Addons for Elementor183,500229100k+Text Domain Mismatch
#11Podlove Podcast Publisher182,3331,4353k+Output is not escaped
#12Realtyna Organic IDX plugin + WPL Real Estate189303,6362k+Non-prefixed global variable
#13Shopping Cart & eCommerce Store185,54117,3973k+Non-prefixed global variable
#14Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution191,218901100k+Exception output is not escaped
#15Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)193,2753,22810k+Output is not escaped
#16Matomo Analytics – Powerful, Privacy-First Insights for WordPress191,911877100k+Exception output is not escaped
#17Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)195403893m+Missing Translators Comment
#18WP Import Export Lite1973797940k+Non-prefixed global variable
#19Brizy – Page Builder2058972070k+Output is not escaped
#20MBE eShip205277401k+Non-prefixed global variable
#21Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization201,3222,7209k+Output is not escaped
#22Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non-prefixed global variable
#23Powered Cache – Caching and Optimization for WordPress – Easily Improve PageSpeed & Web Vitals Score201472313k+Exception output is not escaped
#24Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF20557541100k+Output is not escaped
#25Razorpay for WooCommerce20974855100k+Non-prefixed function
#26Backup Migration219811,09380k+Non-prefixed global variable
#27Comet Cache2185724520k+Output is not escaped
#28Free Downloads WooCommerce214303594k+Output is not escaped
#29Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More212,5721,2771m+Output is not escaped
#30Ebook Store216661,087700Non-prefixed global variable
#31FileOrganizer – WordPress File Manager21536241200k+unlink unlink
#32Mergado Pack212,323588700Output is not escaped
#33Modular DS: Monitor, update, and backup multiple websites211598140k+Exception output is not escaped
#34Royal Addons for Elementor – Addons and Templates Kit for Elementor2113,0112,530600k+Text Domain Mismatch
#35Smart Forms – when you need more than just a contact form217765745k+Output is not escaped
#36WebP Express21160427300k+Non-prefixed global variable
#37Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools217863,39530k+Non-prefixed global variable
#38Wordfence Security – Firewall, Malware Scan, and Login Security211,5922,9735m+Output is not escaped
#39WP Compress – Instant Performance & Speed Optimization213,3673,25310k+Non Singular String Literal Domain
#40WP-Lister Lite for eBay216,6975,1292k+Output is not escaped
#41WP phpMyAdmin214,5286,43550k+Missing Arg Domain
#42Ajax Load More – Infinite Scroll, Load More, & Lazy Load2264159540k+Unsafe printing function
#43Backup Bolt225801,313800Non-prefixed global variable
#44Borderless – Addons and Templates for Elementor224381,3885k+Non-prefixed global variable
#45Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots221,6072,02010k+Direct Query
#46Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms2249329510k+Text Domain Mismatch
#47Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8581,27050k+Text Domain Mismatch
#48Code Profiler – WordPress Performance Profiling and Debugging Made Easy222654008k+Non-prefixed global variable
#49Accept PayPal Payments using Contact Form 722359127600Text Domain Mismatch
#50Directorist: AI-Powered Business Directory, Listings & Classified Ads225492,17520k+Non-prefixed global variable