WordPress.DB.RestrictedClasses.mysql__PDO
mysql PDO
The plugin uses a raw MySQL extension or class instead of WordPress database APIs.
Why It Shows Up
The scan found `mysql_*`, `mysqli_*`, PDO MySQL, or related database functions in plugin code.
Why It Matters
Bypassing `$wpdb` can ignore WordPress database configuration, escaping conventions, character sets, and compatibility layers.
How to Fix
- Replace raw MySQL calls with `$wpdb` methods or higher-level WordPress APIs.
- Use `$wpdb->prepare()` for dynamic values.
- If a third-party library requires a database connection, isolate it and document why WordPress APIs cannot be used.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1 | MDTF – Meta Data and Taxonomies Filter | 16 | 1,550 | 1,956 | 1k+ | Non-prefixed global variable | ||
| #2 | Pagopar – WooCommerce Gateway | 18 | 530 | 1,215 | 400 | Non-prefixed global variable | ||
| #3 | Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution | 19 | 1,218 | 901 | 100k+ | Exception output is not escaped | ||
| #4 | Matomo Analytics – Powerful, Privacy-First Insights for WordPress | 19 | 1,900 | 877 | 100k+ | Exception output is not escaped | ||
| #5 | Captcha Them All | 21 | 300 | 323 | 5k+ | Output is not escaped | ||
| #6 | FileOrganizer – WordPress File Manager | 21 | 536 | 241 | 200k+ | unlink unlink | ||
| #7 | Modular DS: Monitor, update, and backup multiple websites | 21 | 159 | 82 | 40k+ | Exception output is not escaped | ||
| #8 | WP phpMyAdmin | 21 | 4,528 | 6,435 | 50k+ | Missing Arg Domain | ||
| #9 | Database Access with Adminer | 22 | 983 | 2,553 | 1k+ | Non-prefixed global variable | ||
| #10 | File Manager Pro – Filester | 22 | 566 | 391 | 100k+ | Request data is not unslashed | ||
| #11 | WP OAuth Server (OAuth Authentication) | 22 | 189 | 347 | 3k+ | Non-prefixed function | ||
| #12 | Wenprise WeChatPay Payment Gateway For WooCommerce | 22 | 443 | 178 | 400 | Exception output is not escaped | ||
| #13 | WP Umbrella: Security Backup Restore & Monitoring | 22 | 970 | 999 | 80k+ | Exception output is not escaped | ||
| #14 | Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | 23 | 3,719 | 10,280 | 40k+ | Non-prefixed namespace | ||
| #15 | Freshdesk (official) | 23 | 194 | 386 | 800 | Non-prefixed function | ||
| #16 | IP Geo Block | 23 | 399 | 589 | 8k+ | Output is not escaped | ||
| #17 | ManageWP Worker | 23 | 506 | 565 | 1m+ | Non-prefixed class | ||
| #18 | Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning | 23 | 1,118 | 202 | 30k+ | Missing Translators Comment | ||
| #19 | 404 Solution | 24 | 483 | 1,355 | 10k+ | Non-prefixed class | ||
| #20 | ELEX WooCommerce Request a Quote | 24 | 398 | 266 | 2k+ | Request data is not unslashed | ||
| #21 | Database Manager – WP Adminer | 24 | 1,005 | 2,752 | 20k+ | Non-prefixed global variable | ||
| #22 | Post Status Notifier Lite | 24 | 984 | 451 | 700 | Missing direct file access protection | ||
| #23 | SEO Redirection Plugin – 301 Redirect Manager | 24 | 272 | 725 | 10k+ | Non-prefixed global variable | ||
| #24 | CheckoutWC Lite – Conversion optimized WooCommerce checkout | 25 | 1,416 | 854 | 2k+ | Text Domain Mismatch | ||
| #25 | DecaLog | 25 | 943 | 236 | 1k+ | Exception output is not escaped | ||
| #26 | IP Location Block | 25 | 521 | 624 | 10k+ | Output is not escaped | ||
| #27 | Tamara Checkout | 25 | 601 | 228 | 2k+ | Exception output is not escaped | ||
| #28 | SlimStat Analytics | 25 | 1,177 | 870 | 70k+ | Exception output is not escaped | ||
| #29 | WPvivid — Backup, Migration & Staging | 25 | 903 | 1,461 | 900k+ | Non-prefixed namespace | ||
| #30 | FG Drupal to WordPress | 26 | 275 | 100 | 700 | Unsafe printing function | ||
| #31 | FG PrestaShop to WooCommerce | 26 | 254 | 94 | 900 | Unsafe printing function | ||
| #32 | BackUpWordPress | 27 | 245 | 271 | 90k+ | Non-prefixed global variable | ||
| #33 | FG Joomla to WordPress | 27 | 278 | 101 | 7k+ | Unsafe printing function | ||
| #34 | PhastPress | 28 | 101 | 53 | 10k+ | Exception output is not escaped | ||
| #35 | SQLite Database Integration | 29 | 161 | 89 | 3k+ | Exception output is not escaped | ||
| #36 | YASR – Yet Another Star Rating Plugin for WordPress | 30 | 252 | 378 | 10k+ | Output is not escaped | ||
| #37 | FluentAuth – The Ultimate Authorization & Security Plugin for WordPress | 34 | 44 | 229 | 10k+ | Nonce verification recommended | ||
| #38 | ShopBuilder – WooCommerce Builder For Elementor | 39 | 51 | 441 | 10k+ | Non-prefixed global variable |
