PluginScore

WordPress.WP.AlternativeFunctions.file_system_operations_is_writable

file system operations is writable

The plugin performs filesystem work with raw PHP functions where WordPress expects safer filesystem handling.

medium weight

Why It Shows Up

Plugin Check found functions such as `fopen`, `fwrite`, `chmod`, `mkdir`, `readfile`, or related operations.

Why It Matters

WordPress sites can use different filesystem permissions and transports. Raw filesystem calls can fail on common hosts or write to unsafe locations.

How to Fix

  • Use WordPress filesystem helpers when writing, reading, or changing files in plugin-managed paths.
  • Validate paths and keep writes inside directories owned by the plugin or WordPress uploads.
  • Never write PHP code from user input or remote responses.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsUpdatedTop Issue
#1BulletProof Security05,0484,94920k+Output Not Escaped
#2Themify Builder95,1952,0965k+Text Domain Mismatch
#3JetBackup – Backup, Restore & Migrate101,559145100k+Exception Not Escaped
#4Visual Composer Website Builder168232040k+Non Prefixed Variable Found
#5WPtouch – Make your WordPress Website Mobile-Friendly171,46632550k+Text Domain Mismatch
#6Prime Slider Addons for Elementor183,500230100k+Text Domain Mismatch
#7Shopping Cart & eCommerce Store185,45917,2984k+Non Prefixed Variable Found
#8WP Import Export Lite1873897940k+Non Prefixed Variable Found
#9Element Pack – Widgets, Templates & Addons for Elementor199,448517100k+Text Domain Mismatch
#10Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution191,218901100k+Exception Not Escaped
#11Matomo Analytics – Powerful, Privacy-First Insights for WordPress191,909878100k+Exception Not Escaped
#12Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization191,2952,6799k+Output Not Escaped
#13Realtyna Organic IDX plugin + WPL Real Estate199473,6532k+Non Prefixed Variable Found
#14Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)195413853m+Missing Translators Comment
#15Membership Plugin – Kadence Memberships195,0822,9829k+Text Domain Mismatch
#16SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments195261,11990k+Non Prefixed Variable Found
#17WP Email Template193423502k+Exception Not Escaped
#18BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot205081,40630k+Non Prefixed Variable Found
#19GiveWP – Donation Plugin and Fundraising Platform203,4353,580100k+Output Not Escaped
#20Link Library201,9411,39710k+Unsafe Printing Function
#21Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non Prefixed Variable Found
#22Nimble Page Builder201,5911,68430k+Missing Arg Domain
#23Pix por Piggly (para Woocommerce)205471954k+Exception Not Escaped
#24Powered Cache – Caching and Optimization for WordPress – Easily Improve PageSpeed & Web Vitals Score201472313k+Exception Not Escaped
#25Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF20557541100k+Output Not Escaped
#26Store Locator WordPress212,3721,57210k+Text Domain Mismatch
#27Backup Migration219811,09380k+Non Prefixed Variable Found
#28rtMedia for WordPress, BuddyPress and bbPress213636338k+Non Prefixed Constant Found
#29CallTrackingMetrics219232863k+Unsafe Printing Function
#30CartFlows – Funnel Builder & Checkout Plugin for WooCommerce21461614200k+Text Domain Mismatch
#31Comet Cache2185724520k+Output Not Escaped
#32Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More212,5721,2771m+Output Not Escaped
#33EventPrime – Events Calendar, Bookings and Tickets218724,2977k+Non Prefixed Variable Found
#34FileOrganizer – WordPress File Manager21536241200k+unlink unlink
#35Modular DS: Monitor, update, and backup multiple websites211618140k+Exception Not Escaped
#36Packeta218023338k+Exception Not Escaped
#37Five Star Restaurant Reservations – WordPress Booking Plugin211,0991,14710k+Output Not Escaped
#38Smart Forms – when you need more than just a contact form217765745k+Output Not Escaped
#39Buckaroo Woocommerce Payments Plugin215633262k+Exception Not Escaped
#40WebP Express21160427300k+Non Prefixed Variable Found
#41Wise Chat214705065k+Output Not Escaped
#42Paysera Payment Gateway for WooCommerce211,8661957k+Exception Not Escaped
#43Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools217863,39530k+Non Prefixed Variable Found
#44Wordfence Security – Firewall, Malware Scan, and Login Security211,5922,9735m+Output Not Escaped
#45WP-Lister Lite for eBay216,6975,1292k+Output Not Escaped
#46WP phpMyAdmin214,5286,43550k+Missing Arg Domain
#47wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin211,8141,46170k+Output Not Escaped
#48Ajax Load More – Infinite Scroll, Load More, & Lazy Load2264159540k+Unsafe Printing Function
#49Booking for Appointments and Events Calendar – Amelia221,48948090k+Exception Not Escaped
#50Better WordPress Minify224124848k+Non Singular String Literal Domain