SQL query is not prepared

Why It Shows Up

The scan found a SQL string passed to `$wpdb` where variables appear to be interpolated or concatenated directly.

Why It Matters

Unprepared SQL can allow SQL injection when user-controlled values reach the query.

How to Fix

• Move dynamic values into placeholders such as `%s`, `%d`, `%f`, or `%i` where supported.
• Pass the values as separate arguments to `$wpdb->prepare()`.
• For table names, column names, and sort directions, use strict allowlists instead of raw user input.

References