New allegations surfaced that Rank Math has introduced a functionality that silently gives the institution administrator-level permissions complete WordPress sites. The entree is triggered erstwhile a personification installs Rank Math and opens the plugin’s Help & Support area.
Allegedly There Is Zero Consent Or Notification
The developer of The SEO Framework SEO plugin precocious tweeted that erstwhile a personification opens Rank Math’s Help & Support conception that the plugin creates a WordPress Application Password tied to the personification that is opening that Help & Support section. So if the personification who is clicking astir successful the plugin management area has the administrator support level past the WordPress Application Password that Rank Math generates inherits the Administrator-level permissions.
Sybere Waaijer explained:
“Two days ago, Rank Math closed astir a twelve information issues successful 1.0.277. This plugin runs connected complete 4 cardinal sites.
In that aforesaid update, group[.]one (who besides owns WP Rocket) now gets administrative privileges to your site.
Last time, I classified thing for illustration this arsenic a backdoor. This time, you whitethorn decide.
The file: vendor/groupone/wap-client/includes/class-app-password-manager.php.
What it does:
When a tract administrator whose tract is connected to a (free) rankmath[.]com relationship opens “Help & Support,” the plugin instantly creates a WordPress Application Password for that user. It sends that password to group[.]one’s servers. Their AI supplier tin past enactment connected your behalf connected your site.”
WordPress Application Password
WordPress Application Passwords are a legit point successful WordPress, it’s a portion of the WordPress halfway and is thing that plugins tin do. There’s moreover guidelines that show plugin developers really to make WordPress Application Passwords. That’s astir apt why Sybre Waaijer hedged astir categorizing what Rank Math is doing arsenic a backdoor.
Rank Math Does Not Ask For Authorization
One of the respective reasons Waaijer objects to what Rank Math is doing has to do pinch really Rank Math is generating those support levels for itself.
He explained:
“The plugin ne'er asks first. There is simply a “Terms & Conditions” box, but it does not extremity the password from being created aliases sent. The transportation starts earlier the container moreover appears.”
User Authorization Is Built Into WordPress’s Application Password Flow
The charismatic WordPress documentation specifies an authorization surface wherever the plugin identifies itself, the personification is shown the relationship and is fixed the opportunity to o.k. aliases cull it. The specification opportunity that the Application Password is only passed to the plugin erstwhile it has been approved by the user.
Screenshot Of Authorization Example
WordPress.org Explicit Consent Rule
WordPress’s plugin guidelines specify an definitive consent norm successful respect to outer servers. Official guidelines opportunity plugins whitethorn not interaction outer servers without “explicit and authorized consent,” specifying an opt-in checkbox. They besides prohibit automated postulation of personification information without definitive confirmation.
The guidelines specify:
“7. Plugins whitethorn not way users without their consent.
In the liking of protecting personification privacy, plugins whitethorn not interaction outer servers without definitive and authorized consent. This is commonly done via an ‘opt in’ method, requiring registration pinch a work aliases a checkbox wrong the plugin settings. Documentation connected really immoderate personification information is collected, and used, should beryllium included successful the plugin’s readme, preferably pinch a intelligibly stated privateness policy.”
Application Passwords Are Meant To Be Revocable Credentials
WordPress describes Application Passwords arsenic thing that a personification tin reappraisal and revoke.
“Application Passwords are a WordPress characteristic that lets you make revocable, per-application credentials…
And also:
“An Application Password is:
Individually revocable, truthful you tin disable a azygous integration without changing the user’s superior password.”
Waaijer advised really to spell astir revoking the Application Password that the Rank Math support supplier triggers:
“The password shows up connected your floor plan arsenic “WAP – Rank Math Support Agent”. Closing the “Help & Support” tab does not revoke it. This Application Password does not expire. You cannot move the “Support Agent” off.
What you should do:
If you opened “Help & Support” while connected, revoke the Application Passwords immediately.
Go to “WP Admin -> Users -> Profile -> Application Passwords, and revoke thing starting pinch “WAP –”.”
User Responses
User guidance was perfectly antagonistic each the measurement through.
@tprinty’s tweet exemplified the anger that users felt toward Rank Math:
“This is horrible. WP needs SEO arsenic portion of core.”
Rank Math Accused Of Deleting Complaints
@CAwavehello related that the Rank Math chat forum had a large thread astir this taxable and that the chat was subsequently deleted, presumably by Rank Math.
@CAwavehello shared:
“I was wondering what each that fuss was about. There was a immense thread started connected their WP forum page a fewer days agone and now it magically sewage deleted. Got the notification coming they deleted it aft each hellhole collapsed loose connected their users forum. WTF?!”
Users Moving Away From Rank Math
@SwiftyLunatic expressed that they were moving their websites distant from Rank Math:
“Time to move my websites distant from @rankmathseo
why do this you shady company. Best seo plugin to move too, please?”
@SEOMastery2026 tweeted:
“wait admin entree without asking?”
Rank Math Not On SEJ’s Approved Plugin List
Rank Math did not make the trim for MCP’s list of recommended WordPress plugins because 1 of the requirements is that plugins beryllium trustworthy, which includes not having a history of vulnerabilities.
Rank Math had 7 vulnerabilities successful 2024, 4 vulnerabilities successful 2025, and truthful acold successful 2026 location person been 3 vulnerabilities discovered successful Rank Math, including a caller Unauthenticated Stored Cross-Site Scripting vulnerability. Always do a thorough cheque of each plugins that are utilized connected your site, including a information check.
Featured Image by Shutterstock/ViDI Studio
English (US) · 
Indonesian (ID) · 
