WordPress.DB.RestrictedClasses.mysql__mysqli
mysql mysqli
The plugin uses a raw MySQL extension or class instead of WordPress database APIs.
Why It Shows Up
The scan found `mysql_*`, `mysqli_*`, PDO MySQL, or related database functions in plugin code.
Why It Matters
Bypassing `$wpdb` can ignore WordPress database configuration, escaping conventions, character sets, and compatibility layers.
How to Fix
- Replace raw MySQL calls with `$wpdb` methods or higher-level WordPress APIs.
- Use `$wpdb->prepare()` for dynamic values.
- If a third-party library requires a database connection, isolate it and document why WordPress APIs cannot be used.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1 | Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution | 19 | 1,218 | 901 | 100k+ | Exception output is not escaped | ||
| #2 | Backup Migration | 21 | 981 | 1,093 | 80k+ | Non-prefixed global variable | ||
| #3 | rtMedia for WordPress, BuddyPress and bbPress | 21 | 363 | 647 | 7k+ | Non-prefixed constant | ||
| #4 | FileOrganizer – WordPress File Manager | 21 | 536 | 241 | 200k+ | unlink unlink | ||
| #5 | Modular DS: Monitor, update, and backup multiple websites | 21 | 159 | 82 | 40k+ | Exception output is not escaped | ||
| #6 | Wise Chat | 21 | 470 | 506 | 5k+ | Output is not escaped | ||
| #7 | File Manager Pro – Filester | 22 | 566 | 391 | 100k+ | Request data is not unslashed | ||
| #8 | File Manager | 22 | 740 | 520 | 1m+ | Unsafe printing function | ||
| #9 | ManageWP Worker | 23 | 506 | 565 | 1m+ | Non-prefixed class | ||
| #10 | WP BackItUp Community Edition | 23 | 257 | 989 | 6k+ | Non-prefixed global variable | ||
| #11 | Fix Alt Text | 24 | 544 | 346 | 1k+ | Non Singular String Literal Domain | ||
| #12 | InstaWP Connect – 1-click WP Staging & Migration | 24 | 254 | 815 | 40k+ | Non-prefixed global variable | ||
| #13 | WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content | 24 | 1,774 | 394 | 40k+ | Text Domain Mismatch | ||
| #14 | WPBase Cache | 27 | 189 | 113 | 3k+ | Text Domain Mismatch | ||
| #15 | Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin | 28 | 121 | 135 | 3k+ | Non-prefixed global variable | ||
| #16 | Search & Replace | 36 | 50 | 53 | 100k+ | Missing nonce verification | ||
| #17 | Transferito: WP Migration | 88 | 16 | 115 | 500 | Non-prefixed global variable |
