WordPress.WP.AlternativeFunctions.file_system_operations_rmdir
file system operations rmdir
The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.
Why It Shows Up
Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.
Why It Matters
WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.
How to Fix
- Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
- Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
- Never write PHP code from user input or remote responses.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #351 | JetHost Total Care – Security & Enhancements | 45 | 10 | 85 | 800 | Direct Query | ||
| #352 | Updater by BestWebSoft | 46 | 494 | 219 | 2k+ | Text Domain Mismatch | ||
| #353 | Tabby Checkout | 47 | 33 | 46 | 4k+ | Non-prefixed class | ||
| #354 | iControlWP | 47 | 45 | 59 | 1k+ | Missing direct file access protection | ||
| #355 | Compress, Resize & Lazy Load Images – WPvivid Image Optimization | 47 | 107 | 58 | 10k+ | Missing direct file access protection | ||
| #356 | SiteEase Bulk Delete Manager | 49 | 50 | 72 | 900 | Direct Query | ||
| #357 | Analytics by BestWebSoft – Google Analytics Dashboard and Statistic Plugin for WordPress | 49 | 478 | 176 | 1k+ | Text Domain Mismatch | ||
| #358 | Drag and Drop Multiple File Upload for WooCommerce | 49 | 114 | 29 | 5k+ | Text Domain Mismatch | ||
| #359 | WP Smart Import : Import any XML File to WordPress | 49 | 28 | 302 | 1k+ | Non-prefixed global variable | ||
| #360 | BestWebSoft's Twitter | 50 | 477 | 174 | 900 | Text Domain Mismatch | ||
| #361 | Veeqo for WooCommerce | 50 | 30 | 17 | 700 | Missing direct file access protection | ||
| #362 | Quotes and Tips by BestWebSoft | 51 | 485 | 190 | 1k+ | Text Domain Mismatch | ||
| #363 | The Cache Purger | 51 | 16 | 16 | 1k+ | Non Singular String Literal Text | ||
| #364 | TNC Toolbox: Web Performance | 52 | 20 | 25 | 1k+ | Output is not escaped | ||
| #365 | WPVibe – MCP Server for WordPress. Connect Claude, ChatGPT, Gemini & Cursor | 52 | 19 | 58 | 3k+ | Interpolated SQL is not prepared | ||
| #366 | Price Based on Country for WooCommerce | 52 | 43 | 126 | 20k+ | Non-prefixed hook name | ||
| #367 | pretix widget | 53 | 25 | 39 | 400 | Non-prefixed global variable | ||
| #368 | Royal WordPress Backup, Restore & Migration Plugin – Backup WordPress Sites Safely | 53 | 34 | 90 | 20k+ | Database parameter is not escaped | ||
| #369 | AI Agent by SiteGround | 54 | 28 | 6 | 1m+ | Exception output is not escaped | ||
| #370 | BestWebSoft’s Pinterest | 57 | 490 | 176 | 500 | Text Domain Mismatch | ||
| #371 | Easy GDPR Consent Forms – MailChimp | 57 | 72 | 22 | 500 | Text Domain Mismatch | ||
| #372 | Error Log Viewer by BestWebSoft | 58 | 433 | 172 | 6k+ | Text Domain Mismatch | ||
| #373 | Surge | 60 | 46 | 47 | 4k+ | Non-prefixed global variable | ||
| #374 | Falcon – WordPress Optimizations & Tweaks | 62 | 47 | 66 | 2k+ | Short PHP open tag found | ||
| #375 | Embed Google Fonts | 64 | 28 | 7 | 5k+ | Output is not escaped | ||
| #376 | AC Advanced Flamingo Settings | 66 | 6 | 32 | 700 | Nonce verification recommended | ||
| #377 | Easy PHP Settings | 66 | 34 | 48 | 1k+ | Missing Translators Comment | ||
| #378 | Ghost | 70 | 25 | 12 | 600 | Output is not escaped | ||
| #379 | WPThumb | 70 | 30 | 9 | 800 | Output is not escaped | ||
| #380 | Nginx Helper | 71 | 47 | 60 | 200k+ | Non-prefixed global variable | ||
| #381 | Multifile Upload Field for Contact Form 7 | 73 | 41 | 7 | 5k+ | Text Domain Mismatch | ||
| #382 | WPWaterMark 轻水印插件 | 73 | 24 | 17 | 900 | Request data is not unslashed | ||
| #383 | Custom Icons for Elementor and WPBakery | 74 | 35 | 38 | 10k+ | Non-prefixed global variable | ||
| #384 | FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More | 76 | 17 | 333 | 1k+ | Non-prefixed global variable | ||
| #385 | SureRank SEO – Smart Assistant with Meta Tags, Social Preview, XML Sitemap, and Schema | 77 | 58 | 95 | 300k+ | Non-prefixed hook name | ||
| #386 | AIKO – AI Developer Lite | 79 | 10 | 7 | 6k+ | error log error log | ||
| #387 | Physical Custom Upload Folder for Real Media Library | 81 | 4 | 9 | 900 | Nonce verification recommended | ||
| #388 | Cachify | 84 | 9 | 36 | 9k+ | Non-prefixed global variable | ||
| #389 | Real Thumbnail Generator: Efficient regeneration of thumbnails in all sizes | 85 | 5 | 58 | 1k+ | Non-prefixed constant | ||
| #390 | Transferito: WP Migration | 88 | 16 | 115 | 500 | Non-prefixed global variable | ||
| #391 | Post Export Import with Media | 90 | 34 | 41 | 1k+ | Missing Translators Comment | ||
| #392 | MultiManager WP – Manage All Your WordPress Sites Easily | 91 | 28 | 11 | 1k+ | Missing Arg Domain | ||
| #393 | Snow Monkey Forms | 91 | 36 | 41 | 30k+ | Non-prefixed global variable | ||
| #394 | Manage – Centralized site maintenance and monitoring | 95 | 5 | 47 | 70k+ | Direct Query |
