WordPress.WP.AlternativeFunctions.file_system_operations_rmdir
file system operations rmdir
The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.
Why It Shows Up
Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.
Why It Matters
WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.
How to Fix
- Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
- Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
- Never write PHP code from user input or remote responses.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #251 | Kama Thumbnail | 28 | 80 | 47 | 9k+ | Output is not escaped | ||
| #252 | Store Hours for WooCommerce | 28 | 525 | 60 | 2k+ | Output is not escaped | ||
| #253 | Rating by BestWebSoft | 28 | 509 | 218 | 400 | Text Domain Mismatch | ||
| #254 | Sparkle Demo Importer | 28 | 307 | 166 | 5k+ | Text Domain Mismatch | ||
| #255 | WP Synchro – The Ultimate WordPress Migration Tool | 28 | 243 | 244 | 2k+ | Missing Translators Comment | ||
| #256 | Branded Social Images – Open Graph Images with logo and extra text layer | 29 | 254 | 91 | 900 | Non Singular String Literal Domain | ||
| #257 | WPCS – WordPress Currency Switcher Professional | 29 | 84 | 358 | 900 | Non-prefixed global variable | ||
| #258 | DB Cache Reloaded Fix | 29 | 133 | 42 | 2k+ | Output is not escaped | ||
| #259 | reCaptcha by BestWebSoft | 29 | 474 | 272 | 100k+ | Text Domain Mismatch | ||
| #260 | pCloud WP Backup | 29 | 120 | 73 | 1k+ | Exception output is not escaped | ||
| #261 | Relevant – Related, Featured, Latest, and Popular Posts by BestWebSoft | 29 | 487 | 262 | 800 | Text Domain Mismatch | ||
| #262 | Tilda-publishing | 29 | 219 | 78 | 700 | Output is not escaped | ||
| #263 | WP Popular Posts | 29 | 77 | 300 | 100k+ | Non-prefixed global variable | ||
| #264 | Advanced Database Cleaner – Optimize & Clean Database to Speed Up Site Performance | 30 | 173 | 479 | 100k+ | Interpolated SQL is not prepared | ||
| #265 | AI Product Tools – Bulk Product Content Generator & AI Toolkit for WooCommerce | 30 | 508 | 562 | 400 | SQL query is not prepared | ||
| #266 | Contact Form 7 Connector | 30 | 324 | 196 | 5k+ | Text Domain Mismatch | ||
| #267 | Blockons – Gutenberg blocks for WordPress and WooCommerce websites | 30 | 69 | 205 | 700 | Non-prefixed global variable | ||
| #268 | Custom Search by BestWebSoft – WordPress Custom Search Plugin | 30 | 454 | 228 | 900 | Text Domain Mismatch | ||
| #269 | EDI – Обмен данными между WooCommerce и 1С | 30 | 284 | 101 | 600 | Text Domain Mismatch | ||
| #270 | Invisible reCaptcha for WordPress | 30 | 90 | 185 | 80k+ | Input is not sanitized | ||
| #271 | Urvanov Syntax Highlighter | 30 | 221 | 87 | 3k+ | Output is not escaped | ||
| #272 | User Role by BestWebSoft – Add and Customize Roles and Capabilities in WordPress | 30 | 484 | 280 | 3k+ | Text Domain Mismatch | ||
| #273 | WP Docs | 30 | 268 | 271 | 1k+ | Output is not escaped | ||
| #274 | AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization | 31 | 91 | 133 | 2k+ | Output is not escaped | ||
| #275 | Asgaros Forum | 31 | 167 | 412 | 10k+ | Output is not escaped | ||
| #276 | Co-marquage service-public.fr | 31 | 84 | 213 | 1k+ | Non-prefixed global variable | ||
| #277 | Download Plugin | 31 | 78 | 102 | 60k+ | Output is not escaped | ||
| #278 | OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. | 31 | 213 | 62 | 300k+ | Output is not escaped | ||
| #279 | SpeedyCache – Cache, Optimization, Performance | 31 | 65 | 118 | 600k+ | Input is not validated | ||
| #280 | Big File Uploads – Increase Maximum File Upload Size | 31 | 101 | 92 | 100k+ | Output is not escaped | ||
| #281 | Child Theme Configurator | 32 | 442 | 267 | 300k+ | Unsafe printing function | ||
| #282 | Freesoul Deactivate Plugins – Disable plugins on individual WordPress pages | 32 | 53 | 776 | 8k+ | Nonce verification recommended | ||
| #283 | Manager for IcoMoon | 32 | 270 | 68 | 400 | Short PHP open tag found | ||
| #284 | MetaSlider Gallery – Image Gallery, Lightbox Galleries, Modal Windows | 32 | 159 | 62 | 10k+ | Output is not escaped | ||
| #285 | Pagination by BestWebSoft – Customizable WordPress Content Splitter and Navigation Plugin | 32 | 446 | 173 | 5k+ | Text Domain Mismatch | ||
| #286 | Restrict Usernames Emails Characters | 32 | 327 | 367 | 1k+ | Output is not escaped | ||
| #287 | Shariff Wrapper | 32 | 33 | 404 | 30k+ | Non-prefixed global variable | ||
| #288 | Tumult Hype Animations | 32 | 56 | 117 | 1k+ | Output is not escaped | ||
| #289 | ImageLinks – Interactive Image Builder with Hotspots | 33 | 517 | 90 | 1k+ | Text Domain Mismatch | ||
| #290 | LWSCache | 33 | 47 | 104 | 6k+ | Non-prefixed global variable | ||
| #291 | Merge + Minify + Refresh | 33 | 78 | 26 | 4k+ | date date | ||
| #292 | WOW Slider | 33 | 176 | 101 | 3k+ | Output is not escaped | ||
| #293 | XML Sitemaps | 33 | 65 | 62 | 2k+ | Output is not escaped | ||
| #294 | Cache Master | 34 | 371 | 27 | 400 | Output is not escaped | ||
| #295 | Campi Moduli Italiani | 34 | 72 | 363 | 500 | Unquoted Complex Placeholder | ||
| #296 | FV Gravatar Cache | 34 | 50 | 42 | 600 | Output is not escaped | ||
| #297 | Garden Gnome Package | 34 | 116 | 51 | 4k+ | Text Domain Mismatch | ||
| #298 | Gitium | 34 | 149 | 57 | 400 | Output is not escaped | ||
| #299 | Greenshift – animation and page builder blocks | 34 | 33 | 272 | 70k+ | Non-prefixed global variable | ||
| #300 | Image Cleanup | 34 | 52 | 94 | 1k+ | Nonce verification recommended |
