WordPress.WP.AlternativeFunctions.file_system_operations_touch
file system operations touch
The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.
Why It Shows Up
Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.
Why It Matters
WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.
How to Fix
- Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
- Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
- Never write PHP code from user input or remote responses.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1 | BulletProof Security | 0 | 5,048 | 4,949 | 20k+ | Output is not escaped | ||
| #2 | JetBackup – Backup, Restore & Migrate | 10 | 1,563 | 149 | 200k+ | Exception output is not escaped | ||
| #3 | Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution | 19 | 1,218 | 901 | 100k+ | Exception output is not escaped | ||
| #4 | Matomo Analytics – Powerful, Privacy-First Insights for WordPress | 19 | 1,900 | 877 | 100k+ | Exception output is not escaped | ||
| #5 | Netgsm | 19 | 334 | 308 | 1k+ | Setting is missing a sanitization callback | ||
| #6 | WP Import Export Lite | 19 | 737 | 979 | 40k+ | Non-prefixed global variable | ||
| #7 | Microthemer Lite – Visual Editor to Customize CSS | 20 | 1,004 | 1,699 | 10k+ | Non-prefixed global variable | ||
| #8 | Pix por Piggly (para Woocommerce) | 20 | 547 | 195 | 4k+ | Exception output is not escaped | ||
| #9 | Powered Cache – Caching and Optimization for WordPress – Easily Improve PageSpeed & Web Vitals Score | 20 | 147 | 231 | 3k+ | Exception output is not escaped | ||
| #10 | Razorpay for WooCommerce | 20 | 975 | 859 | 100k+ | Non-prefixed function | ||
| #11 | Backup Migration | 21 | 981 | 1,093 | 80k+ | Non-prefixed global variable | ||
| #12 | Kadence Security – Password, Two Factor Authentication, and Brute Force Protection | 21 | 1,060 | 957 | 700k+ | Missing Translators Comment | ||
| #13 | rtMedia for WordPress, BuddyPress and bbPress | 21 | 363 | 647 | 7k+ | Non-prefixed constant | ||
| #14 | Captcha Them All | 21 | 300 | 323 | 5k+ | Output is not escaped | ||
| #15 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More | 21 | 2,572 | 1,277 | 1m+ | Output is not escaped | ||
| #16 | FileOrganizer – WordPress File Manager | 21 | 536 | 241 | 200k+ | unlink unlink | ||
| #17 | LA-Studio Element Kit for Elementor | 21 | 8,403 | 1,882 | 10k+ | Text Domain Mismatch | ||
| #18 | Modular DS: Monitor, update, and backup multiple websites | 21 | 159 | 82 | 40k+ | Exception output is not escaped | ||
| #19 | Smart Forms – when you need more than just a contact form | 21 | 776 | 574 | 5k+ | Output is not escaped | ||
| #20 | TotalPoll for Polls and Contests | 21 | 1,366 | 155 | 1k+ | Text Domain Mismatch | ||
| #21 | UPC/EAN/GTIN Barcode Generator/Importer | 21 | 776 | 311 | 500 | Exception output is not escaped | ||
| #22 | Wordfence Security – Firewall, Malware Scan, and Login Security | 21 | 1,592 | 2,973 | 5m+ | Output is not escaped | ||
| #23 | WP Compress – Instant Performance & Speed Optimization | 21 | 3,367 | 3,253 | 10k+ | Non Singular String Literal Domain | ||
| #24 | WP-Lister Lite for eBay | 21 | 6,697 | 5,129 | 2k+ | Output is not escaped | ||
| #25 | Backup Bolt | 22 | 580 | 1,313 | 800 | Non-prefixed global variable | ||
| #26 | Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer | 22 | 2,854 | 1,269 | 50k+ | Text Domain Mismatch | ||
| #27 | Code Profiler – WordPress Performance Profiling and Debugging Made Easy | 22 | 265 | 400 | 8k+ | Non-prefixed global variable | ||
| #28 | File Manager Pro – Filester | 22 | 566 | 391 | 100k+ | Request data is not unslashed | ||
| #29 | NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall | 22 | 1,263 | 2,046 | 100k+ | Non-prefixed global variable | ||
| #30 | NinjaScanner – Virus & Malware scan | 22 | 596 | 551 | 30k+ | Non-prefixed global variable | ||
| #31 | Packeta | 22 | 801 | 333 | 8k+ | Exception output is not escaped | ||
| #32 | PDF Builder for WPForms | 22 | 321 | 266 | 900 | SQL query is not prepared | ||
| #33 | PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP | 22 | 984 | 407 | 5k+ | Unsafe printing function | ||
| #34 | RabbitLoader Cache: Optimize your Website for Speed | 22 | 241 | 163 | 2k+ | Output is not escaped | ||
| #35 | Seraphinite Accelerator | 22 | 595 | 255 | 50k+ | Output is not escaped | ||
| #36 | ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF | 22 | 1,044 | 800 | 300k+ | Non-prefixed global variable | ||
| #37 | SNS Count Cache | 22 | 918 | 120 | 7k+ | Non Singular String Literal Domain | ||
| #38 | Swift Performance Lite | 22 | 2,346 | 1,325 | 6k+ | Text Domain Mismatch | ||
| #39 | File Manager | 22 | 740 | 520 | 1m+ | Unsafe printing function | ||
| #40 | WP-WebAuthn | 22 | 957 | 396 | 2k+ | Exception output is not escaped | ||
| #41 | WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell | 22 | 6,004 | 2,764 | 5k+ | Text Domain Mismatch | ||
| #42 | YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports | 22 | 654 | 435 | 10k+ | Exception output is not escaped | ||
| #43 | ЮKassa для WooCommerce | 22 | 591 | 167 | 9k+ | Short PHP open tag found | ||
| #44 | Frontend Admin by DynamiApps | 23 | 5,946 | 3,231 | 9k+ | Text Domain Mismatch | ||
| #45 | Autoptimize | 23 | 288 | 191 | 800k+ | Output is not escaped | ||
| #46 | Geo Controller | 23 | 91 | 450 | 1k+ | Non-prefixed global variable | ||
| #47 | FV Flowplayer Video Player | 23 | 1,311 | 1,454 | 20k+ | Output is not escaped | ||
| #48 | InfiniteWP Client | 23 | 2,287 | 1,811 | 200k+ | Exception output is not escaped | ||
| #49 | Import WP – Export and Import CSV and XML files to WordPress | 23 | 579 | 324 | 4k+ | Exception output is not escaped | ||
| #50 | Media Library Assistant | 23 | 1,131 | 3,759 | 70k+ | Nonce verification recommended |
