Rank Math is accused of creating an admin level WordPress Application Password without asking

Sybre Waaijer, the developer of The SEO Framework, wrote between 28 and 30 August 2026 that Rank Math version 1.0.277 contains code which creates a WordPress Application Password carrying Administrator level access, and that it does so the moment an administrator opens the plugin's Help and Support section on a site connected to a free rankmath.com account. Search Engine Journal reported the accusation on 30 August 2026, and that article carries no statement and no denial from Rank Math.

The useful part of this story is short, and it does not depend on who turns out to be right. Open WP Admin, go to Users, then Profile, then the Application Passwords section, and revoke any entry whose name starts with "WAP -". That is a minute per site. An Application Password revoked by mistake can be issued again later, so there is no cost to checking.

What the code is said to do

Waaijer's claim, as reported by Search Engine Journal on 30 August 2026, points at one specific file inside the plugin: vendor/groupone/wap-client/includes/class-app-password-manager.php, shipped in Rank Math 1.0.277. He says that file generates a WordPress Application Password when an administrator whose site is connected to a free rankmath.com account opens the plugin's Help and Support section, and that the credential inherits that user's Administrator permission level rather than a reduced one.

Waaijer also says the credential is transmitted to servers run by group.one, the company behind Rank Math, which also owns WP Rocket, so that its AI agent can act on the site. In his account this is not a token that stays on the server it was created on. It leaves the site.

The part of the claim that carries the most weight is consent. Waaijer says the plugin never asks first. He describes a Terms and Conditions box that exists in the interface but does not gate creation of the password, and says the transfer starts before that box appears. If that sequence is accurate, an administrator would never reach a point where declining was an option, because the thing they would be declining has already happened.

The properties Waaijer describes

The specifics below are the ones reported by Search Engine Journal on 30 August 2026, attributed to Waaijer. They are worth reading as a checklist, because each one is something a site owner can verify in their own WordPress install rather than take on trust.

The last row is the one that changes the shape of the problem. A credential that expires on its own is a short window. A credential that persists until somebody deletes it by hand is a standing key, and standing keys are only as safe as the last person who audited them.

How to check your own installs

The remedy Waaijer gives is manual and takes place entirely inside WordPress. There is nothing to install and nothing to buy.

1. Log in to WP Admin on the site.
2. Go to Users, then open the profile of an account with the Administrator role.
3. Scroll to the Application Passwords section.
4. Revoke any entry whose name begins with "WAP -", including "WAP - Rank Math Support Agent".
5. Repeat for every other Administrator on the site, not only your own account.

That last step is the one people skip. Application Passwords are stored per user, so checking your own profile tells you nothing about the agency account, the developer account, or the former staff member whose admin login was never downgraded. On a site with five administrators there are five profiles to open. If you keep a list of who holds admin on which client site, this is the week to use it.

What WordPress core says an Application Password is

WordPress core documents Application Passwords as revocable credentials issued per application, handed out through an authorization screen on which the requesting application identifies itself and the user approves the request. That documented flow is the benchmark Waaijer is measuring the plugin against. The authorization screen is where consent happens, and the per application scoping is what lets a site owner cut off one integration without breaking the others.

Separately, WordPress.org guideline 7 for plugins bars a plugin from contacting external servers without the user's explicit opt in consent. Waaijer's description, if accurate, would put the behaviour on the wrong side of that guideline. Whether the WordPress.org plugin review team agrees is a separate question, and Search Engine Journal did not report any ruling from them.

What is not established

Rank Math had not responded in the Search Engine Journal report. There is no denial to weigh, no account of the intent behind the code, and no statement about whether the behaviour will change in a later release. Anyone summarising this story as a confirmed breach is going further than the reporting does.

Waaijer himself hedged on whether to call it a backdoor. That hesitation is meaningful rather than decorative, because the label is the whole argument. A support feature built with bad defaults and a deliberately hidden entry point produce the same profile entry and call for the same fix, but they are not the same accusation.

Users also reported that a large complaint thread on Rank Math's own support forum was deleted. That report comes from users rather than from Rank Math, and moderation on a vendor forum can have reasons that have nothing to do with the substance of the complaint. It is part of why the story spread, not evidence of what the code does.

The security record cited alongside the claim

Search Engine Journal set the accusation against Rank Math's recent vulnerability record: 7 vulnerabilities in 2024, 4 in 2025 and 3 so far in 2026, including a recent unauthenticated stored cross site scripting issue. Read plainly, that is a plugin with an ordinary flow of disclosed and patched issues rather than a quiet one.

It is worth holding two facts together here. Version 1.0.277 is the release at the centre of the accusation, and version 1.0.277 is also the release that closed about a dozen security issues. Rolling back to an older version to avoid the Application Password behaviour would mean rolling back past those fixes. Revoking the credential in the user profile does not require rolling anything back.

Rank Math runs on more than 4 million sites. That figure is the reason a dispute between one plugin developer and another became a story worth reading on a Sunday, and it is the reason the check is worth running even on the small sites nobody has logged into for a year.

Why an admin level credential matters more than it sounds

An Application Password with Administrator permissions is not scoped to SEO settings. Administrator is the top role in WordPress: it can install and activate plugins, edit or delete any page, change canonical tags and redirects, add users, and publish content. For anyone responsible for a site's search performance, a credential at that level is editorial access and technical access at the same time, which is why it belongs on the list of things a periodic SEO audit looks at rather than a purely security concern handed to somebody else.

This is also an argument for keeping the administrator list on a WordPress build short. Every extra admin account is another profile that can hold an Application Password, another place a credential can sit unnoticed, and another person who has to remember to check. Agencies that build and maintain sites for clients tend to accumulate these accounts over years of handovers, and the cleanup rarely happens on its own. If you are already planning website work, the user table is a cheap thing to tidy at the same time.

What this means for Thai marketers

Nothing in the Search Engine Journal report is specific to Thailand, and the article makes no claims about any country. The relevance is structural. WordPress is the default build for a large share of Thai SME sites, and Rank Math is a common choice on those builds because the free tier covers most of what a small site needs. Any Thai business running WordPress with Rank Math is in the population Waaijer is describing, on exactly the same terms as a site anywhere else.

The practical wrinkle here is ownership. On many Thai SME sites the WordPress admin account belongs to whoever built the site, sometimes a freelancer who has not been in touch for two years, and the marketing team has an editor login rather than an administrator one. If you cannot see the Application Passwords section, you are not looking at an administrator profile, and someone else on the project has an account that needs checking. Ask who that is before you conclude the site is clean.

FAQ on the Rank Math accusation

Is my site affected if nobody has opened Help and Support?

Waaijer describes the trigger as an administrator opening the plugin's Help and Support section on a site connected to a free rankmath.com account, so on his account a site where that never happened would not have the credential. The reliable way to know is to look: the Application Passwords section of each administrator profile either lists an entry starting with "WAP -" or it does not.

Does closing the tab or logging out revoke it?

No. Waaijer specifically says the password does not expire, cannot be turned off, and is not revoked by closing the tab. It stays until somebody revokes it in the user profile.

Does uninstalling Rank Math remove the password?

Search Engine Journal did not report whether removing the plugin revokes the credential. The remedy in the report is the manual one, revoking anything beginning with "WAP -" in WP Admin, Users, Profile, Application Passwords. Do that step regardless of whether you also remove the plugin.

Has Rank Math answered the accusation?

Not in the Search Engine Journal report, which carries no statement and no denial. If that changes, the version of the story you are reading here will be out of date, so check the source before repeating any part of it as settled.

Should we stop using Rank Math?

That is a judgement call the reporting does not make for you, and this is an accusation by a named third party with no response from the accused rather than a confirmed finding. The steps that hold either way are revoking the "WAP -" entries, keeping the plugin updated so you keep the security fixes shipped in 1.0.277, and knowing who holds administrator accounts on your sites.

Is this a backdoor?

Waaijer declined to settle on that word, and Search Engine Journal reported the hedge rather than resolving it. What is described is an Administrator level credential created without a prompt and sent to a third party server. Whether that is a design failure or something intentional is not established by the reporting.

If you are unsure who holds administrator access across your WordPress sites, or you want the Rank Math check done alongside a proper look at what else is sitting in the user table, Relevant Audience can go through it with you.