WordPress.DB.DirectDatabaseQuery.DirectQuery
Direct Query
The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.
Why It Shows Up
Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.
Why It Matters
Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.
How to Fix
- Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
- If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
- Keep schema changes in activation or upgrade routines and make them idempotent.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #3051 | Bulk Page Creator | 62 | 9 | 17 | 10k+ | Request data is not unslashed | ||
| #3052 | Carousel Slider | 62 | 71 | 30k+ | Non-prefixed global variable | |||
| #3053 | Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages | 62 | 81 | 100 | 40k+ | Missing direct file access protection | ||
| #3054 | Custom Permalink Editor | 62 | 4 | 51 | 3k+ | Non-prefixed hook name | ||
| #3055 | DreamHost Automated Migration | 62 | 15 | 23 | 20k+ | Output is not escaped | ||
| #3056 | exovia GDPR Google Maps | 62 | 40 | 6 | 4k+ | Output is not escaped | ||
| #3057 | Falcon – WordPress Optimizations & Tweaks | 62 | 47 | 66 | 2k+ | Short PHP open tag found | ||
| #3058 | Import entries for Gravity Forms | 62 | 6 | 26 | 500 | Input is not validated | ||
| #3059 | Migrate To Liquid Web & Nexcess | 62 | 15 | 23 | 2k+ | Output is not escaped | ||
| #3060 | Pressable Automated Migration | 62 | 15 | 23 | 3k+ | Output is not escaped | ||
| #3061 | Proofreading | 62 | 11 | 74 | 5k+ | Direct Query | ||
| #3062 | Spam Comments Cleaner | 62 | 14 | 29 | 1k+ | Non-prefixed function | ||
| #3063 | Topic SEO Content Optimization Tool | 62 | 35 | 15 | 1k+ | curl curl close | ||
| #3064 | Woo Product Remover | 62 | 23 | 14 | 1k+ | SQL query is not prepared | ||
| #3065 | Embed Videos For Product Image Gallery Using WooCommerce | 62 | 21 | 16 | 400 | Text Domain Mismatch | ||
| #3066 | WP Category Sort | 62 | 15 | 22 | 500 | Text Domain Mismatch | ||
| #3067 | XPoster – Share to Bluesky and Mastodon | 62 | 26 | 36 | 10k+ | Missing nonce verification | ||
| #3068 | Migrate to WordPress.com | 62 | 15 | 28 | 2k+ | Output is not escaped | ||
| #3069 | Automatic Featured Images from Videos | 63 | 14 | 13 | 7k+ | Missing direct file access protection | ||
| #3070 | Classic Editor and Classic Widgets | 63 | 18 | 41 | 20k+ | Nonce verification recommended | ||
| #3071 | Placeholder Image for WooCommerce | 63 | 31 | 5 | 400 | Output is not escaped | ||
| #3072 | Image Sitemap | 63 | 11 | 14 | 400 | Output is not escaped | ||
| #3073 | IndexNow Plugin | 63 | 14 | 91 | 100k+ | error log error log | ||
| #3074 | Missed Scheduled Posts Publisher by WPBeginner | 63 | 16 | 17 | 30k+ | Text Domain Mismatch | ||
| #3075 | MooWoodle – WordPress Moodle LMS Integration, Sell Moodle Courses via WooCommerce | 63 | 10 | 45 | 800 | No Caching | ||
| #3076 | Contact Form to Chat Apps | Click to Chat to Order – FormyChat | 63 | 30 | 134 | 3k+ | Direct Query | ||
| #3077 | Collapsing Archives | 64 | 36 | 9 | 3k+ | date date | ||
| #3078 | CV Demo Importer | 64 | 21 | 95 | 400 | Non-prefixed global variable | ||
| #3079 | DataFeedWatch Connector for WooCommerce | 64 | 16 | 112 | 600 | Non-prefixed hook name | ||
| #3080 | DoFollow Case by Case | 64 | 4 | 60 | 1k+ | Direct Query | ||
| #3081 | ELEX WooCommerce Product Price Custom Text (Before & After Text) and Discount | 64 | 444 | 137 | 2k+ | Missing Arg Domain | ||
| #3082 | Icon Element – Icon Pack for Elementor Page Builder (6718 icons) | 64 | 30 | 16 | 40k+ | wp function not compatible with requires wp | ||
| #3083 | Inactive Logout | 64 | 30 | 71 | 10k+ | Non-prefixed global variable | ||
| #3084 | Inline Related Posts | 64 | 17 | 39 | 100k+ | Nonce verification recommended | ||
| #3085 | Pageviews | 64 | 15 | 12 | 1k+ | Missing Translators Comment | ||
| #3086 | Stancer for WooCommerce | 64 | 2 | 108 | 400 | Non-prefixed global variable | ||
| #3087 | JTL-Connector for WooCommerce | 64 | 7 | 166 | 1k+ | Direct Query | ||
| #3088 | WP REST API Controller | 64 | 8 | 22 | 8k+ | Nonce verification recommended | ||
| #3089 | WP REST Cache | 64 | 11 | 113 | 10k+ | Direct Query | ||
| #3090 | WP Term Order | 64 | 2 | 26 | 6k+ | Nonce verification recommended | ||
| #3091 | AdSimple Cookie Consent Banner | 65 | 55 | 109 | 600 | wp function not compatible with requires wp | ||
| #3092 | Custom Share Buttons with Floating Sidebar | 65 | 164 | 20 | 4k+ | Text Domain Mismatch | ||
| #3093 | Cyr to Lat Reloaded – Transliteration of Links and File Names | 65 | 13 | 36 | 30k+ | Direct Query | ||
| #3094 | Dashboard Directory Size | 65 | 32 | 9 | 400 | Missing Arg Domain | ||
| #3095 | Email Tracker | 65 | 25 | 4 | 800 | SQL query is not prepared | ||
| #3096 | Integration for Elementor forms – Sendinblue | 65 | 94 | 56 | 7k+ | Text Domain Mismatch | ||
| #3097 | Bitrix24 | 65 | 28 | 10 | 500 | Text Domain Mismatch | ||
| #3098 | License For Envato | 65 | 9 | 28 | 9k+ | Non-prefixed global variable | ||
| #3099 | Notibar – Notification Bar for WordPress | 65 | 43 | 62 | 8k+ | wp function not compatible with requires wp | ||
| #3100 | Royal MCP – Secure AI Connector for Claude, ChatGPT & Gemini | 65 | 6 | 33 | 7k+ | Interpolated SQL is not prepared |
