WordPress.DB.PreparedSQLPlaceholders.ReplacementsWrongNumber
Replacements Wrong Number
A SQL query is built in a way that Plugin Check cannot verify as safely prepared.
Why It Shows Up
The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.
Why It Matters
Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.
How to Fix
- Keep placeholders in the SQL string and pass dynamic values as separate arguments.
- Use the placeholder that matches the value type.
- Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #201 | WPVibe – MCP Server for WordPress. Connect Claude, ChatGPT, Gemini & Cursor | 52 | 19 | 58 | 3k+ | Interpolated SQL is not prepared | ||
| #202 | Booking Calendar | 54 | 28 | 85 | 50k+ | Mixed line endings | ||
| #203 | ProductFrame – Curated products from affiliate feeds | 55 | 3 | 85 | 400 | Direct Query | ||
| #204 | License For Envato | 58 | 12 | 31 | 9k+ | Non-prefixed global variable | ||
| #205 | Academy LMS | 61 | 18 | 521 | 2k+ | Non-prefixed global variable | ||
| #206 | Contact Form to Chat Apps | Click to Chat to Order – FormyChat | 63 | 30 | 134 | 3k+ | Direct Query | ||
| #207 | Multilingual Forms for Fluent Forms with WPML | 67 | 52 | 16 | 1k+ | Text Domain Mismatch | ||
| #208 | WooCommerce Shipping | 71 | 48 | 70k+ | Direct Query | |||
| #209 | Duplicate Taxonomy Term | 74 | 9 | 5 | 2k+ | Nonce verification recommended | ||
| #210 | Sublium Subscriptions – Subscriptions for WooCommerce – Recurring Payments, Subscription Plans & Installments | 74 | 35 | 22 | 400 | wp function not compatible with requires wp | ||
| #211 | FlowForms – Conversational Form Builder | 75 | 17 | 400 | Nonce verification recommended | |||
| #212 | UTM Event Tracker and Analytics, UTM Grabber | 76 | 2 | 19 | 900 | Interpolated SQL is not prepared | ||
| #213 | WP AdCenter – Ad Manager & Adsense Ads | 76 | 5 | 71 | 1k+ | Direct Query | ||
| #214 | Bricksable for Bricks Builder | 80 | 1 | 76 | 10k+ | Post Not In exclude | ||
| #215 | HivePress Reviews | 90 | 5 | 11 | 7k+ | Non-prefixed global variable |
