WordPress.WP.AlternativeFunctions.file_system_operations_touch
file system operations touch
The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.
Why It Shows Up
Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.
Why It Matters
WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.
How to Fix
- Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
- Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
- Never write PHP code from user input or remote responses.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1 | BulletProof Security | 0 | 5,048 | 4,949 | 20k+ | Output is not escaped | ||
| #2 | JetBackup – Backup, Restore & Migrate | 10 | 1,567 | 156 | 200k+ | Exception output is not escaped | ||
| #3 | 404 Solution | 15 | 582 | 1,532 | 10k+ | Non-prefixed class | ||
| #4 | Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution | 18 | 1,229 | 923 | 100k+ | Exception output is not escaped | ||
| #5 | Matomo Analytics – Powerful, Privacy-First Insights for WordPress | 19 | 1,993 | 892 | 100k+ | Exception output is not escaped | ||
| #6 | Netgsm | 19 | 352 | 348 | 1k+ | Non-prefixed global variable | ||
| #7 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More | 20 | 2,878 | 1,988 | 1m+ | Non-prefixed global variable | ||
| #8 | Microthemer Lite – Visual Editor to Customize CSS | 20 | 1,004 | 1,699 | 10k+ | Non-prefixed global variable | ||
| #9 | Pix por Piggly (para Woocommerce) | 20 | 547 | 195 | 4k+ | Exception output is not escaped | ||
| #10 | Powered Cache – Caching and Optimization for WordPress – Easily Improve PageSpeed & Web Vitals Score | 20 | 147 | 231 | 3k+ | Exception output is not escaped | ||
| #11 | WP Compress – Instant Performance & Speed Optimization | 20 | 4,292 | 3,691 | 10k+ | Non Singular String Literal Domain | ||
| #12 | Backup Migration | 21 | 999 | 1,081 | 80k+ | Non-prefixed global variable | ||
| #13 | Kadence Security – Password, Two Factor Authentication, and Brute Force Protection | 21 | 1,060 | 959 | 700k+ | Missing Translators Comment | ||
| #14 | Captcha Them All | 21 | 300 | 323 | 5k+ | Output is not escaped | ||
| #15 | FileOrganizer – WordPress File Manager | 21 | 549 | 261 | 200k+ | unlink unlink | ||
| #16 | LA-Studio Element Kit for Elementor | 21 | 8,403 | 1,882 | 10k+ | Text Domain Mismatch | ||
| #17 | Modular DS: Monitor, update, and backup multiple websites | 21 | 199 | 82 | 40k+ | Exception output is not escaped | ||
| #18 | Smart Forms – when you need more than just a contact form | 21 | 776 | 574 | 5k+ | Output is not escaped | ||
| #19 | TotalPoll for Polls and Contests | 21 | 1,366 | 155 | 1k+ | Text Domain Mismatch | ||
| #20 | UPC/EAN/GTIN Barcode Generator/Importer | 21 | 776 | 311 | 500 | Exception output is not escaped | ||
| #21 | Razorpay for WooCommerce | 21 | 980 | 864 | 100k+ | Non-prefixed function | ||
| #22 | Wordfence Security – Firewall, Malware Scan, and Login Security | 21 | 1,893 | 3,292 | 5m+ | Output is not escaped | ||
| #23 | WP-Lister Lite for eBay | 21 | 6,701 | 5,140 | 2k+ | Output is not escaped | ||
| #24 | Frontend Admin by DynamiApps | 22 | 5,943 | 3,232 | 8k+ | Text Domain Mismatch | ||
| #25 | Backup Bolt | 22 | 580 | 1,313 | 800 | Non-prefixed global variable | ||
| #26 | Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer | 22 | 2,854 | 1,269 | 40k+ | Text Domain Mismatch | ||
| #27 | Code Profiler – WordPress Performance Profiling and Debugging Made Easy | 22 | 265 | 400 | 8k+ | Non-prefixed global variable | ||
| #28 | File Manager Pro – Filester | 22 | 584 | 411 | 100k+ | Request data is not unslashed | ||
| #29 | NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall | 22 | 1,263 | 2,046 | 100k+ | Non-prefixed global variable | ||
| #30 | NinjaScanner – Virus & Malware scan | 22 | 596 | 551 | 30k+ | Non-prefixed global variable | ||
| #31 | Packeta | 22 | 801 | 341 | 8k+ | Exception output is not escaped | ||
| #32 | PDF Builder for WPForms | 22 | 321 | 268 | 900 | SQL query is not prepared | ||
| #33 | PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP | 22 | 984 | 407 | 5k+ | Unsafe printing function | ||
| #34 | Seraphinite Accelerator | 22 | 587 | 243 | 50k+ | Output is not escaped | ||
| #35 | ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF | 22 | 1,047 | 802 | 300k+ | Non-prefixed global variable | ||
| #36 | SNS Count Cache | 22 | 918 | 120 | 7k+ | Non Singular String Literal Domain | ||
| #37 | Swift Performance Lite | 22 | 2,346 | 1,325 | 6k+ | Text Domain Mismatch | ||
| #38 | File Manager | 22 | 740 | 520 | 1m+ | Unsafe printing function | ||
| #39 | WP-WebAuthn | 22 | 957 | 396 | 2k+ | Exception output is not escaped | ||
| #40 | YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports | 22 | 1,366 | 477 | 10k+ | Offloaded Content | ||
| #41 | ЮKassa для WooCommerce | 22 | 728 | 210 | 9k+ | Short PHP open tag found | ||
| #42 | Autoptimize | 23 | 288 | 191 | 800k+ | Output is not escaped | ||
| #43 | Geo Controller | 23 | 87 | 484 | 1k+ | Non-prefixed global variable | ||
| #44 | FV Flowplayer Video Player | 23 | 1,280 | 1,456 | 10k+ | Output is not escaped | ||
| #45 | InfiniteWP Client | 23 | 2,379 | 1,844 | 200k+ | Exception output is not escaped | ||
| #46 | Import WP – CSV & XML Import Export for WordPress | 23 | 579 | 326 | 4k+ | Exception output is not escaped | ||
| #47 | Media Library Assistant | 23 | 1,105 | 3,144 | 70k+ | Nonce verification recommended | ||
| #48 | Next Active Directory Integration | 23 | 693 | 285 | 2k+ | Exception output is not escaped | ||
| #49 | NitroPack – Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization | 23 | 293 | 645 | 90k+ | Non-prefixed global variable | ||
| #50 | PowerPress Podcasting plugin by Blubrry | 23 | 4,793 | 2,461 | 20k+ | Output is not escaped |
