Rank Math, the SEO plugin running on more than 4 million WordPress sites, shipped an update on August 26 that reportedly creates an administrator-level login credential the moment a site admin opens the plugin’s Help & Support screen, before anyone clicks a consent box.
What happened
The claim comes from Sybre Waaijer, developer of the competing SEO plugin The SEO Framework, in a post on X. He says Rank Math version 1.0.277 added a file, vendor/groupone/wap-client/includes/class-app-password-manager.php, that generates a WordPress Application Password for the account viewing Help & Support, and sends it to the servers of group.one, the company Waaijer says also owns WP Rocket. If that account is an administrator, the password inherits full admin rights and, per Waaijer, an AI support agent can then act on the site through it.
Application Passwords are a real WordPress core feature that plugins are allowed to use, and Waaijer said that’s why he stopped short of calling this a backdoor outright. But WordPress’s own integration guide describes an authorization screen that names the requesting plugin and lets the user approve or reject the connection before a password is issued. Waaijer says Rank Math’s flow skips that: a “Terms & Conditions” notice appears, but the password is generated and transmitted before a user can respond to it.
Rank Math’s own changelog for 1.0.277 says the release closed close to a dozen security issues with outside researchers’ help and introduced the Support Agent feature. A quick follow-up, 1.0.277.1, shipped a day later, but its fix addressed an unrelated notice display bug, not the consent flow Waaijer flagged. WPWithin found no public statement from Rank Math addressing the allegation directly.
What to do
Waaijer says the credential appears on a user’s WordPress profile labeled “WAP – Rank Math Support Agent” and does not expire or disappear when the Help & Support tab is closed. If you or another admin on your site has opened that screen while connected to a Rank Math account, go to Users → Profile → Application Passwords and revoke anything starting with “WAP –”. If you don’t recognize the entry, revoke it anyway.
End of article