WordPress.WP.AlternativeFunctions.file_system_operations_rmdir
file system operations rmdir
The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.
Why It Shows Up
Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.
Why It Matters
WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.
How to Fix
- Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
- Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
- Never write PHP code from user input or remote responses.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #51 | Directorist: AI-Powered Business Directory, Listings & Classified Ads | 22 | 549 | 2,175 | 20k+ | Non-prefixed global variable | ||
| #52 | Download Manager | 22 | 2,513 | 1,462 | 100k+ | Output is not escaped | ||
| #53 | E2Pdf – Export Pdf Tool for WordPress | 22 | 1,075 | 836 | 10k+ | Unsafe printing function | ||
| #54 | File Manager Pro – Filester | 22 | 565 | 391 | 100k+ | Request data is not unslashed | ||
| #55 | Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | 22 | 407 | 236 | 700k+ | Text Domain Mismatch | ||
| #56 | Insert or Embed Articulate Content into WordPress | 22 | 659 | 1,437 | 2k+ | Non-prefixed global variable | ||
| #57 | InfiniteWP Client | 22 | 2,286 | 1,812 | 200k+ | Exception output is not escaped | ||
| #58 | JCH Optimize | 22 | 1,145 | 136 | 4k+ | Output is not escaped | ||
| #59 | NinjaScanner – Virus & Malware scan | 22 | 596 | 551 | 30k+ | Non-prefixed global variable | ||
| #60 | Packeta | 22 | 801 | 333 | 8k+ | Exception output is not escaped | ||
| #61 | PDF Builder for WPForms | 22 | 321 | 266 | 900 | SQL query is not prepared | ||
| #62 | Smart Popup by Supsystic | 22 | 3,172 | 503 | 10k+ | Non Singular String Literal Domain | ||
| #63 | Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | 22 | 1,581 | 2,326 | 300k+ | Non-prefixed global variable | ||
| #64 | Prime Mover – Migrate WordPress Website & Backups | 22 | 1,326 | 1,600 | 10k+ | Non-prefixed global variable | ||
| #65 | Product Catalog Feed by PixelYourSite | 22 | 581 | 357 | 8k+ | Output is not escaped | ||
| #66 | PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP | 22 | 984 | 407 | 5k+ | Unsafe printing function | ||
| #67 | Seraphinite Accelerator | 22 | 594 | 255 | 50k+ | Output is not escaped | ||
| #68 | ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF | 22 | 1,044 | 800 | 300k+ | Non-prefixed global variable | ||
| #69 | SSL Zen — SSL Certificate Installer & HTTPS Redirects | 22 | 751 | 1,605 | 10k+ | Non-prefixed global variable | ||
| #70 | Swift Performance Lite | 22 | 2,346 | 1,325 | 6k+ | Text Domain Mismatch | ||
| #71 | Theme Editor | 22 | 798 | 685 | 50k+ | Output is not escaped | ||
| #72 | Unlimited Elements Blocks Library | 22 | 708 | 1,822 | 400 | Non-prefixed global variable | ||
| #73 | RapidLoad AI – Optimize Web Vitals Automatically | 22 | 81 | 840 | 700 | Nonce verification recommended | ||
| #74 | WooCommerce | 22 | 1,359 | 6,172 | 7m+ | Non-prefixed global variable | ||
| #75 | ManageWP Worker | 22 | 507 | 565 | 1m+ | Non-prefixed class | ||
| #76 | Asset CleanUp: Page Speed Booster | 22 | 2,030 | 2,485 | 100k+ | Non-prefixed global variable | ||
| #77 | File Manager | 22 | 740 | 520 | 1m+ | Unsafe printing function | ||
| #78 | WP Umbrella: Update Backup Restore & Monitoring | 22 | 921 | 919 | 70k+ | Exception output is not escaped | ||
| #79 | WP-WebAuthn | 22 | 957 | 396 | 2k+ | Exception output is not escaped | ||
| #80 | Advanced Form Integration — Connect Forms to 200+ Apps | 23 | 5,783 | 4,687 | 10k+ | wp function not compatible with requires wp | ||
| #81 | Affiliate Super Assistent | 23 | 1,280 | 267 | 1k+ | Text Domain Mismatch | ||
| #82 | Autoptimize | 23 | 288 | 191 | 800k+ | Output is not escaped | ||
| #83 | Kadence Security – Password, Two Factor Authentication, and Brute Force Protection | 23 | 1,053 | 967 | 700k+ | Missing Translators Comment | ||
| #84 | BuddyPress | 23 | 584 | 9,012 | 100k+ | Non-prefixed function | ||
| #85 | Business Directory Plugin – Easy Listing Directories for WordPress | 23 | 611 | 1,063 | 10k+ | Non-prefixed global variable | ||
| #86 | CLUEVO LMS, E-Learning Platform | 23 | 1,843 | 1,176 | 400 | Text Domain Mismatch | ||
| #87 | Content Egg – Affiliate Product Importer & Price Comparison | 23 | 1,245 | 1,275 | 10k+ | Non-prefixed global variable | ||
| #88 | Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe | 23 | 9,315 | 26,644 | 1k+ | Non-prefixed global variable | ||
| #89 | DK PDF – WordPress PDF Generator | 23 | 744 | 335 | 3k+ | Exception output is not escaped | ||
| #90 | Ezoic | 23 | 432 | 516 | 10k+ | Output is not escaped | ||
| #91 | Fastcache by Host.it | 23 | 1,327 | 203 | 800 | Text Domain Mismatch | ||
| #92 | Front End PM | 23 | 978 | 2,264 | 5k+ | Non-prefixed global variable | ||
| #93 | Gmedia Photo Gallery | 23 | 350 | 1,121 | 7k+ | Non-prefixed global variable | ||
| #94 | Groovy Menu Plugin (Free) | 23 | 1,729 | 283 | 4k+ | Text Domain Mismatch | ||
| #95 | Interactive Content – H5P | 23 | 565 | 380 | 40k+ | Non Singular String Literal Domain | ||
| #96 | Masteriyo LMS – LMS Course Builder, Quizzes & Certificates | 23 | 190 | 2,122 | 5k+ | Non-prefixed global variable | ||
| #97 | Master Slider – Responsive Touch Slider | 23 | 800 | 408 | 60k+ | Output is not escaped | ||
| #98 | Media Library Assistant | 23 | 1,131 | 3,759 | 70k+ | Nonce verification recommended | ||
| #99 | MediaPress | 23 | 904 | 583 | 4k+ | Output is not escaped | ||
| #100 | MultiParcels Shipping For WooCommerce | 23 | 196 | 362 | 4k+ | Mixed line endings |
