WordPress.DB.DirectDatabaseQuery.DirectQuery
Direct Query
The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.
Why It Shows Up
Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.
Why It Matters
Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.
How to Fix
- Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
- If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
- Keep schema changes in activation or upgrade routines and make them idempotent.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #3351 | Vanilla PDF Embed | 85 | 8 | 3 | 3k+ | parse url parse url | ||
| #3352 | Boxtal – Shipping solution | 86 | 3 | 92 | 9k+ | Non-prefixed global variable | ||
| #3353 | Counters Block – Animated Number Counters, Stats & Dynamic KPIs | 86 | 5 | 14 | 3k+ | Missing direct file access protection | ||
| #3354 | Getnet Argentina para WooCommerce | 86 | 14 | 9 | 500 | Text Domain Mismatch | ||
| #3355 | La Poste Pro Expéditions WooCommerce | 86 | 3 | 95 | 1k+ | Non-prefixed global variable | ||
| #3356 | LWS Affiliation | 86 | 8 | 23 | 700 | Missing nonce verification | ||
| #3357 | Nice page transition | 86 | 4 | 12 | 1k+ | Direct Query | ||
| #3358 | Delete product images for WooCommerce | 86 | 3 | 13 | 1k+ | Direct Query | ||
| #3359 | PayPal Enterprise Payments (formerly Braintree) for WooCommerce | 86 | 3 | 33 | 10k+ | Direct Query | ||
| #3360 | Connect Contact Form 7 to Mailchimp, Brevo, MailerLite & Klaviyo | 87 | 444 | 42 | 40k+ | Text Domain Mismatch | ||
| #3361 | Enable Abilities for MCP | 87 | 48 | 1k+ | Direct Query | |||
| #3362 | GTM Kit – Google Tag Manager & GA4 integration | 87 | 5 | 17 | 30k+ | Missing direct file access protection | ||
| #3363 | I Recommend This – Love/Like Button for WordPress Posts | 87 | 3 | 49 | 5k+ | Direct Query | ||
| #3364 | Image Optimization – Compress Images and Convert to WebP or AVIF | 87 | 15 | 24 | 1m+ | Missing Translators Comment | ||
| #3365 | ImageKit – URL based image manipulation and optimization | 87 | 47 | 42 | 1k+ | Non-prefixed global variable | ||
| #3366 | Menu Caching | 87 | 3 | 12 | 500 | Request data is not unslashed | ||
| #3367 | Bulk Page Generator and Mass Page Builder – Page Generator | 87 | 26 | 87 | 4k+ | Non-prefixed global variable | ||
| #3368 | ParcelWILL (Formerly ParcelPanel) – Shipment Tracking, Tracking & Order Tracking for WooCommerce | 87 | 6 | 81 | 7k+ | Non-prefixed global variable | ||
| #3369 | Snitch | 87 | 5 | 19 | 900 | Nonce verification recommended | ||
| #3370 | Variations as Single Product – Display Single Variation for WooCommerce | 87 | 8 | 33 | 1k+ | Direct Query | ||
| #3371 | WP Missed Schedule Posts | 87 | 7 | 9 | 10k+ | trademarked term | ||
| #3372 | CPO Content Types | 88 | 13 | 25 | 3k+ | Missing direct file access protection | ||
| #3373 | Hindi-To-Lat | 88 | 3 | 14 | 400 | Direct Query | ||
| #3374 | Include Me | 88 | 7 | 7 | 4k+ | Short PHP open tag found | ||
| #3375 | Lightbox with PhotoSwipe | 88 | 1 | 24 | 20k+ | Non-prefixed global variable | ||
| #3376 | WPS Bookings for WooCommerce | 88 | 26 | 249 | 4k+ | Non-prefixed global variable | ||
| #3377 | SiteGround Email Marketing | 88 | 18 | 75 | 1k+ | Non-prefixed namespace | ||
| #3378 | Smart Blocks – WordPress Gutenberg Blocks | 88 | 10 | 76 | 1k+ | Post Not In post not in | ||
| #3379 | Ukr-To-Lat | 88 | 3 | 13 | 5k+ | Direct Query | ||
| #3380 | User IP and Location | 88 | 2 | 10 | 3k+ | Input is not sanitized | ||
| #3381 | Divi Carousel Free (Divi5 Support) | 88 | 268 | 26 | 30k+ | Text Domain Mismatch | ||
| #3382 | WPC Admin Columns | 88 | 30 | 1k+ | Direct Query | |||
| #3383 | Archivarix External Images Importer | 89 | 8 | 35 | 1k+ | Non-prefixed global variable | ||
| #3384 | Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More | 89 | 13 | 20 | 2k+ | wp function not compatible with requires wp | ||
| #3385 | Custom Layouts – Post + Product grids made easy | 89 | 23 | 22 | 4k+ | Missing Translators Comment | ||
| #3386 | Location Add-on For Gravity Forms | 89 | 18 | 16 | 400 | Text Domain Mismatch | ||
| #3387 | Real Custom Post Order: Create a custom order for your content | 89 | 1 | 19 | 8k+ | Non-prefixed global variable | ||
| #3388 | SiteLock Security – WP Hardening, Login Security & Malware Scans | 89 | 44 | 9 | 1k+ | Text Domain Mismatch | ||
| #3389 | Statify | 89 | 5 | 33 | 100k+ | Direct Query | ||
| #3390 | Taxonomy Metadata | 89 | 4 | 9 | 4k+ | Direct Query | ||
| #3391 | WP Featherlight Disabled | 89 | 5 | 11 | 2k+ | trademarked term | ||
| #3392 | Disable User Login | 89 | 1 | 20 | 500 | Direct Query | ||
| #3393 | WPC Smart Notifications for WooCommerce | 89 | 79 | 600 | Non-prefixed global variable | |||
| #3394 | Beehive Analytics – Google Analytics Dashboard | 90 | 611 | 22 | 20k+ | Text Domain Mismatch | ||
| #3395 | Cimo – Free Instant Image Optimizer & WebP Converter | 90 | 6 | 4 | 9k+ | Missing Translators Comment | ||
| #3396 | Compact Archives | 90 | 8 | 14 | 2k+ | Non-prefixed function | ||
| #3397 | Disable Revisions | 90 | 5 | 5 | 1k+ | Direct Query | ||
| #3398 | External files in Media Library | 90 | 16 | 68 | 400 | Direct Query | ||
| #3399 | Featured Image Admin Thumb | 90 | 7 | 10 | 20k+ | Non-prefixed hook name | ||
| #3400 | Hide Related Video Youtube | 90 | 3 | 8 | 1k+ | Direct Query |
