Rank Math WordPress Plugin Accused Of Secretly Taking Admin Access via @sejournal, @martinibuster
All Paid Media PPC News Social MediaAdvertising Video Advertising Columns Ask A PPC ExpertNEW PPC Pulse Webinar ChatGPT Ads Or GEO: What To Buy, What To Earn Audit where ChatGPT places your brand, then get the rule for when Ads win, when GEO wins, and when running both beats either one. Digital Marketing All Digital Marketing Analytics & Data Ecommerce Lead Generation Content Marketing Social Platforms Google YouTube Reddit LinkedIn TikTokNEW WordPress Other CMS Platforms Webinar ChatGPT Ads Or GEO: What To Buy, What To Earn Audit where ChatGPT places your brand, then get the rule for when Ads win, when GEO wins, and when running both beats either one. SEJ Live Webinars Rundowns PodcastNEW Ebooks All Resources Webinar Where AI Gets Its Answers In Your Industry Google rankings don't show which sources AI cites. Get the breakdown by engine and industry, plus the steps to earn a place in it. SEJ STAFF Roger Montti 4 seconds ago ⋅ 5 min read SEJ STAFF Roger Montti Owner - Martinibuster.com at Martinibuster.com Bio Follow New allegations surfaced that Rank Math has introduced a functionality that silently gives the company administrator-level permissions over WordPress sites. The access is triggered when a user installs Rank Math and opens the plugin’s Help & Support area. The developer of The SEO Framework SEO plugin recently tweeted that when a user opens Rank Math’s Help & Support section that the plugin creates a WordPress Application Password tied to the user that is opening that Help & Support section. So if the user who is clicking around in the plugin administration area has the administrator permission level then the WordPress Application Password that Rank Math generates inherits the Administrator-level permissions. “Two days ago, Rank Math closed about a dozen security issues in 1.0.277. This plugin runs on over 4 million sites. In that same update, group[.]one (who also owns WP Rocket) now gets administrative privileges to your site. Last time, I classified something like this as a backdoor. This time, you may decide. The file: vendor/groupone/wap-client/includes/class-app-password-manager.php. What it does: When a site administrator whose site is connected to a (free) rankmath[.]com account opens “Help & Support,” the plugin immediately creates a WordPress Application Password for that user. It sends that password to group[.]one’s servers. Their AI agent can then act on your behalf on your site.” WordPress Application Passwords are a legit thing in WordPress, it’s a part of the WordPress core and is something that plugins can do. There’s even guidelines that tell plugin developers how to generate WordPress Application Passwords. That’s probably why Sybre Waaijer hedged about categorizing what Rank Math is doing as a backdoor. One of the several reasons Waaijer objects to what Rank Math is doing has to do with how Rank Math is generating those permission levels for itself. “The plugin never asks first. There is a “Terms & Conditions” box, but it does not stop the password from being created or sent. The transfer starts before the box even appears.” The official WordPress documentation specifies an authorization screen where the plugin identifies itself, the user is shown the connection and is given the opportunity to approve or reject it. The specification say that the Application Password is only passed to the plugin once it has been approved by the user. WordPress’s plugin guidelines specify an explicit consent rule in regard to external servers. Official guidelines say plugins may not contact external servers without “explicit and authorized consent,” specifying an opt-in checkbox. They also prohibit automated collection of user data without explicit confirmation. WordPress describes Application Passwords as something that a user can review and revoke. “Application Passwords are a WordPress feature that lets you generate revocable, per-application credentials… Individually revocable, so you can disable a single integration without changing the user’s primary password.” Waaijer advised how to go about revoking the Application Password that the Rank Math support agent triggers: “The password shows up on your profile as “WAP – Rank Math Support Agent”. Closing the “Help & Support” tab does not revoke it. This Application Password does not expire. You cannot turn the “Support Agent” off. What you should do: If you opened “Help & Support” while connected, revoke the Application Passwords immediately. Go to “WP Admin -> Users -> Profile -> Application Passwords, and revoke anything starting with “WAP –”.” @tprinty’s tweet exemplified the anger that users felt toward Rank Math: “This is horrible. WP needs SEO as part of core.” @CAwavehello related that the Rank Math discussion forum had a big thread about this topic and that the discussion was subsequently deleted, presumably by Rank Math. “I was wondering what all that fuss was about. There was a huge thread started on their WP forum page a few days ago and now it magically got deleted. Got the notification today they deleted it after all hell broke loose on their users forum. WTF?!” @SwiftyLunatic expressed that they were moving their websites away from Rank Math: why do this you shady company. Best seo plugin to switch too, please?” Rank Math did not make the cut for Search Engine Journal’s list of recommended WordPress plugins because one of the requirements is that plugins be trustworthy, which includes not having a history of vulnerabilities. Rank Math had seven vulnerabilities in 2024, four vulnerabilities in 2025, and so far in 2026 there have been three vulnerabilities discovered in Rank Math, including a recent Unauthenticated Stored Cross-Site Scripting vulnerability. Always do a thorough check of all plugins that are used on your site, including a security check. Add SEJ as a preferred source on Google Read Full Bio SEJ STAFF Roger Montti Owner - Martinibuster.com at Martinibuster.com I have 25 years hands-on experience in SEO, evolving along with the search engines by keeping up with the latest ... Learn how to connect search, AI, and PPC into one unstoppable strategy. Google Tests AI Search Data, UK Requires Opt Out – SEO Pulse How To Become A Strategic Partner & Keep Clients Years Longer AI Search Isn’t Replacing Google, It’s Layering On Top – Similarweb Data Join 75,000+ Digital Leaders. Learn how to connect search, AI, and PPC into one unstoppable strategy. Learn how to connect search, AI, and PPC into one unstoppable strategy.
Source: Search Engine Journal
This article has been carefully curated and reformatted for educational and informational purposes. Full credit goes to the original publisher.
📚 Visit more helpful articles on Joab Peters Blog
No comments