Rank Math has temporarily disabled its Support Agent feature, two days after we reported that the SEO plugin was generating admin-level login credentials without asking first.
What happened
Rank Math confirmed the problem in a post on its knowledge base: the Support Agent, which answers support questions by reading data from a user’s site, was creating a WordPress Application Password credential for that access without clearly telling users what was happening. “The concern we heard from some users was that the plugin was not explaining clearly enough that credentials were generated for the AI agents,” the company wrote.
Rank Math maintains the credentials were encrypted, not stored on its servers, limited to the permissions of the WordPress user already logged in, and read-only, meaning the agent couldn’t change anything on a site. But it acknowledged that isn’t the point. “When an AI agent is being given permission to create an application password, you should be told clearly and directly what is happening and what you’re allowing,” the company said. “That feedback is fair, and we take responsibility for making this clearer.”
The Support Agent will return once Rank Math rebuilds the access-request flow so it asks for permission in plain language before any credentials are created, rather than after. The company hasn’t given a date for when that will ship.
What to do
If you already revoked the Application Password labeled “WAP – Rank Math Support Agent” from Users → Profile → Application Passwords, no further action is needed for now. The feature is off, so it won’t recreate that credential until Rank Math ships the redesigned version. Watch for that update before opening Help & Support again.
End of article