WordPress.DB.DirectDatabaseQuery.DirectQuery
Direct Query
The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.
Why It Shows Up
Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.
Why It Matters
Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.
How to Fix
- Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
- If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
- Keep schema changes in activation or upgrade routines and make them idempotent.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #3201 | Bing URL Submissions Plugin | 74 | 10 | 38 | 40k+ | error log error log | ||
| #3202 | BP xProfile Location | 74 | 7 | 24 | 600 | Missing nonce verification | ||
| #3203 | Duplicate Taxonomy Term | 74 | 9 | 5 | 2k+ | Nonce verification recommended | ||
| #3204 | Edit Author Slug | 74 | 5 | 8 | 100k+ | Output is not escaped | ||
| #3205 | ELEX WooCommerce USPS Shipping Method | 74 | 139 | 45 | 800 | Text Domain Mismatch | ||
| #3206 | EmailKit – Email Customizer for WooCommerce & WP | 74 | 17 | 82 | 70k+ | slow db query meta query | ||
| #3207 | Fast Speed Index | 74 | 9 | 12 | 500 | Direct Query | ||
| #3208 | Free Shipping Label and Progress Bar for WooCommerce | 74 | 60 | 5k+ | Non-prefixed hook name | |||
| #3209 | Plugin Notes Plus | 74 | 2 | 42 | 9k+ | Non-prefixed hook name | ||
| #3210 | Post My CF7 Form | 74 | 21 | 168 | 2k+ | Non-prefixed global variable | ||
| #3211 | Product Layouts for WooCommerce | 74 | 5 | 75 | 1k+ | Direct Query | ||
| #3212 | Email Deliverability – SMTP Replacement, Email API Deliverability & Email Log | 74 | 8 | 23 | 200k+ | Output is not escaped | ||
| #3213 | Change Storefront Footer Copyright Text | 74 | 71 | 21 | 4k+ | Text Domain Mismatch | ||
| #3214 | WP API SwaggerUI | 74 | 14 | 20 | 2k+ | Missing direct file access protection | ||
| #3215 | WP-Sweep | 74 | 1 | 201 | 100k+ | Direct Query | ||
| #3216 | Zion Builder – Website Builder for Speed & Creativity | 74 | 4 | 29 | 1k+ | Non-prefixed hook name | ||
| #3217 | Bulk Comments Management | 75 | 6 | 25 | 700 | Direct Query | ||
| #3218 | Cognito Forms | 75 | 13 | 4 | 2k+ | wp function not compatible with requires wp | ||
| #3219 | Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ | 75 | 306 | 70k+ | Non-prefixed global variable | |||
| #3220 | FlowForms – Conversational Form Builder | 75 | 17 | 400 | Nonce verification recommended | |||
| #3221 | FluentPlayer – Video Player With Forms & Lead Capture | 75 | 10 | 40 | 1k+ | Database parameter is not escaped | ||
| #3222 | Force First and Last Name as Display Name | 75 | 5 | 12 | 2k+ | Missing nonce verification | ||
| #3223 | Intuitive Custom Post Order | 75 | 19 | 96 | 400k+ | Direct Query | ||
| #3224 | Invoice Gateway for WooCommerce – Invoice Payment Gateway | 75 | 3 | 30 | 2k+ | Nonce verification recommended | ||
| #3225 | Open Graph Protocol Framework | 75 | 17 | 12 | 3k+ | Missing direct file access protection | ||
| #3226 | WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation | 75 | 2 | 60 | 1k+ | Database parameter is not escaped | ||
| #3227 | PopupAlly | 75 | 40 | 10 | 2k+ | Missing direct file access protection | ||
| #3228 | Post Type Switcher | 75 | 3 | 18 | 200k+ | Direct Query | ||
| #3229 | Matterport Shortcode | 75 | 21 | 30 | 3k+ | Text Domain Mismatch | ||
| #3230 | Simple Taxonomy Ordering | 75 | 7 | 10 | 10k+ | Direct Query | ||
| #3231 | Ukrposhta | 75 | 24 | 226 | 500 | Non-prefixed global variable | ||
| #3232 | WPSSO WP Sitemaps XML with News, Image, and Video Sitemap | 75 | 60 | 24 | 400 | Missing Translators Comment | ||
| #3233 | Addonify – WooCommerce Wishlist | 76 | 30 | 43 | 1k+ | Non-prefixed global variable | ||
| #3234 | Ajax Search Lite – Live Search & Filter | 76 | 126 | 264 | 80k+ | Non-prefixed hook name | ||
| #3235 | Autocomplete WooCommerce Orders | 76 | 70 | 55 | 30k+ | Text Domain Mismatch | ||
| #3236 | Clear Cache Everywhere | 76 | 7 | 17 | 700 | Nonce verification recommended | ||
| #3237 | FileBird Document Library | 76 | 23 | 13 | 5k+ | Text Domain Mismatch | ||
| #3238 | FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More | 76 | 17 | 333 | 1k+ | Non-prefixed global variable | ||
| #3239 | Leo Product Recommendations for WooCommerce | 76 | 3 | 79 | 400 | Short URL found | ||
| #3240 | RS Template Builder For Elementor – Complete Control Over Headers, Footers & More | 76 | 11 | 56 | 1k+ | Post Not In exclude | ||
| #3241 | Search Regex | 76 | 6 | 25 | 100k+ | Direct Query | ||
| #3242 | StoreAgent – WooCommerce AI Chatbot & AI Content Tools | 76 | 202 | 400 | Non-prefixed global variable | |||
| #3243 | Category Order and Taxonomy Terms Order | 76 | 35 | 10 | 500k+ | wp function not compatible with requires wp | ||
| #3244 | UTM Event Tracker and Analytics, UTM Grabber | 76 | 2 | 19 | 900 | Interpolated SQL is not prepared | ||
| #3245 | WEN Featured Image | 76 | 1 | 18 | 3k+ | Input is not validated | ||
| #3246 | WP AdCenter – Ad Manager & Adsense Ads | 76 | 5 | 71 | 1k+ | Direct Query | ||
| #3247 | ACF Galerie 4 | 77 | 16 | 23 | 2k+ | Text Domain Mismatch | ||
| #3248 | Backup/Restore Divi Theme Options | 77 | 8 | 8 | 700 | Input is not validated | ||
| #3249 | Custom Fonts – Host Your Fonts Locally | 77 | 14 | 20 | 400k+ | Request data is not unslashed | ||
| #3250 | Dual Currency Display | 77 | 1 | 24 | 900 | Direct Query |
