WordPress.DB.RestrictedClasses.mysql__PDO
mysql PDO
The plugin uses a raw MySQL extension or class instead of WordPress database APIs.
Why It Shows Up
The scan found `mysql_*`, `mysqli_*`, PDO MySQL, or related database functions in plugin code.
Why It Matters
Bypassing `$wpdb` can ignore WordPress database configuration, escaping conventions, character sets, and compatibility layers.
How to Fix
- Replace raw MySQL calls with `$wpdb` methods or higher-level WordPress APIs.
- Use `$wpdb->prepare()` for dynamic values.
- If a third-party library requires a database connection, isolate it and document why WordPress APIs cannot be used.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1 | 404 Solution | 15 | 582 | 1,532 | 10k+ | Non-prefixed class | ||
| #2 | MDTF – Meta Data and Taxonomies Filter | 16 | 1,550 | 1,956 | 1k+ | Non-prefixed global variable | ||
| #3 | Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution | 18 | 1,229 | 923 | 100k+ | Exception output is not escaped | ||
| #4 | Pagopar – WooCommerce Gateway | 18 | 530 | 1,215 | 400 | Non-prefixed global variable | ||
| #5 | Matomo Analytics – Powerful, Privacy-First Insights for WordPress | 19 | 1,993 | 892 | 100k+ | Exception output is not escaped | ||
| #6 | Captcha Them All | 21 | 300 | 323 | 5k+ | Output is not escaped | ||
| #7 | FileOrganizer – WordPress File Manager | 21 | 549 | 261 | 200k+ | unlink unlink | ||
| #8 | Modular DS: Monitor, update, and backup multiple websites | 21 | 199 | 82 | 40k+ | Exception output is not escaped | ||
| #9 | WP phpMyAdmin | 21 | 4,528 | 6,435 | 40k+ | Missing Arg Domain | ||
| #10 | Database Access with Adminer | 22 | 983 | 2,553 | 1k+ | Non-prefixed global variable | ||
| #11 | File Manager Pro – Filester | 22 | 584 | 411 | 100k+ | Request data is not unslashed | ||
| #12 | WP OAuth Server (OAuth Authentication) | 22 | 189 | 345 | 3k+ | Non-prefixed function | ||
| #13 | Wenprise WeChatPay Payment Gateway For WooCommerce | 22 | 443 | 178 | 400 | Exception output is not escaped | ||
| #14 | WP Umbrella: Security Backup Restore & Monitoring | 22 | 1,001 | 1,191 | 80k+ | Exception output is not escaped | ||
| #15 | Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | 23 | 3,702 | 8,486 | 40k+ | Non-prefixed namespace | ||
| #16 | Freshdesk (official) | 23 | 194 | 386 | 800 | Non-prefixed function | ||
| #17 | IP Geo Block | 23 | 399 | 589 | 8k+ | Output is not escaped | ||
| #18 | ManageWP Worker | 23 | 501 | 570 | 1m+ | Non-prefixed class | ||
| #19 | Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning | 23 | 1,202 | 239 | 30k+ | Missing Translators Comment | ||
| #20 | Database Manager – WP Adminer | 24 | 1,005 | 2,752 | 20k+ | Non-prefixed global variable | ||
| #21 | Post Status Notifier Lite | 24 | 984 | 451 | 700 | Missing direct file access protection | ||
| #22 | SEO Redirection Plugin – 301 Redirect Manager | 24 | 272 | 725 | 10k+ | Non-prefixed global variable | ||
| #23 | Tamara Checkout | 24 | 603 | 248 | 2k+ | Exception output is not escaped | ||
| #24 | CheckoutWC Lite – Conversion optimized WooCommerce checkout | 25 | 1,420 | 857 | 2k+ | Text Domain Mismatch | ||
| #25 | DecaLog | 25 | 943 | 236 | 1k+ | Exception output is not escaped | ||
| #26 | ELEX WooCommerce Request a Quote | 25 | 397 | 262 | 2k+ | Request data is not unslashed | ||
| #27 | IP Location Block | 25 | 409 | 528 | 10k+ | Output is not escaped | ||
| #28 | SlimStat Analytics | 25 | 1,177 | 870 | 70k+ | Exception output is not escaped | ||
| #29 | WPvivid — Backup, Migration & Staging | 25 | 1,000 | 1,464 | 900k+ | Non-prefixed namespace | ||
| #30 | FG Drupal to WordPress | 26 | 273 | 101 | 700 | Unsafe printing function | ||
| #31 | BackUpWordPress | 27 | 245 | 271 | 80k+ | Non-prefixed global variable | ||
| #32 | FG Joomla to WordPress | 27 | 278 | 101 | 7k+ | Unsafe printing function | ||
| #33 | FG PrestaShop to WooCommerce | 27 | 252 | 94 | 900 | Unsafe printing function | ||
| #34 | FluentAuth – Login Security, Two-Factor Authentication, Passkeys & Social Login | 28 | 273 | 284 | 10k+ | Missing Translators Comment | ||
| #35 | PhastPress | 28 | 101 | 53 | 10k+ | Exception output is not escaped | ||
| #36 | YASR – Yet Another Star Rating Plugin for WordPress | 30 | 252 | 378 | 10k+ | Output is not escaped | ||
| #37 | ShopBuilder – WooCommerce Builder For Elementor | 35 | 50 | 458 | 10k+ | Non-prefixed global variable |
