The Rank Math WordPress SEO plugin, installed on more than 4 million websites, generates administrator-level Application Passwords and transmits them to its parent company's servers without explicit user authorization, according to an August 28 disclosure by Sybre Waaijer, developer of The SEO Framework plugin, reported by Search Engine Journal.
TL;DR: Rank Math automatically creates WordPress Application Passwords with admin privileges when users open the plugin's Help & Support section, sending credentials to group.one servers without consent screens required by WordPress.org guidelines.
How the Access Mechanism Works
Waaijer explained that when a site administrator with an active Rank Math account connection opens the plugin's Help & Support section, Rank Math immediately generates a WordPress Application Password tied to that user's permission level. If the user holds administrator privileges, the generated password inherits full admin access to the WordPress installation.
"When a site administrator whose site is connected to a (free) rankmath.com account opens 'Help & Support,' the plugin immediately creates a WordPress Application Password for that user," Waaijer said in his disclosure. "It sends that password to group.one's servers. Their AI agent can then act on your behalf on your site."
The mechanism resides in vendor/groupone/wap-client/includes/class-app-password-manager.php within the Rank Math codebase. Group.one owns both Rank Math and WP Rocket.
WordPress Guidelines Require Explicit Consent
WordPress.org plugin directory guidelines mandate explicit consent before plugins contact external servers. Guideline 7 states that plugins "may not contact external servers without explicit and authorized consent," typically implemented through opt-in checkboxes or service registration flows with documented privacy policies.
Waaijer reported that Rank Math does not present an authorization screen before generating credentials. "The plugin never asks first," he said. "There is a 'Terms & Conditions' box, but it does not stop the password from being created or sent. The transfer starts before the box even appears."
The official WordPress Application Password specification documents an authorization screen where the requesting application identifies itself and users approve or reject the connection before credentials are transmitted. WordPress describes Application Passwords as "individually revocable" credentials that users can review and disable per integration without changing their primary account password.
The Application Password appears in WordPress user profiles as "WAP – Rank Math Support Agent" and does not expire automatically. Closing the Help & Support tab does not revoke the credential.
Similar authorization bypass patterns in WordPress plugins have previously triggered security disclosures and emergency patches. The broader pattern of WordPress plugin vulnerabilities launching exploits within hours of disclosure has prompted agencies to tighten vendor-vetting protocols.
User Reaction and Forum Moderation
WordPress community response was uniformly negative. Developer @tprinty called the practice "horrible" and suggested WordPress needs SEO functionality in core to avoid third-party plugin risks.
Multiple users reported that Rank Math deleted discussion threads about the issue from its official support forum. Developer @CAwavehello said, "There was a huge thread started on their WP forum page a few days ago and now it magically got deleted. Got the notification today they deleted it after all hell broke loose."
Users began publicly announcing migrations away from Rank Math. @SwiftyLunatic posted, "Time to move my websites away from @rankmathseo. Why do this you shady company."
The disclosure follows a wave of WordPress plugin security incidents in August 2026, including MiniOrange authentication bypass vulnerabilities under active exploit, Elementor Ally SQL injection affecting 400,000 sites, and WPForms generating one-hour admin tokens during onboarding.
What This Means for Agency Owners
Agencies managing client WordPress installations should immediately audit which sites run Rank Math with active account connections. Any administrator who opened the Help & Support section while connected created an Application Password that persists until manually revoked.
Waaijer recommends navigating to WP Admin → Users → Profile → Application Passwords and revoking any entry starting with "WAP –". This action does not disable Rank Math's SEO functionality but removes external access credentials.
The incident underscores why vendor security practices belong in agency onboarding checklists alongside feature comparisons. WordPress.org guidelines exist specifically to prevent silent data transmission, but plugin directory enforcement remains reactive rather than proactive. Agencies relying on white-label development services should verify that partners maintain documented plugin vetting protocols, including review of authorization flows before deploying any plugin that connects to external APIs or support infrastructure.
The Application Password mechanism itself is legitimate WordPress core functionality designed for headless CMS integrations and third-party tool access. The objection centers on implementation: creating and transmitting credentials without presenting WordPress's standard authorization screen violates both platform guidelines and user-consent expectations that distinguish legitimate integrations from unauthorized access.