The WordPress ecosystem is currently reeling from a severe security and privacy controversy surrounding Rank Math, one of the most popular SEO plugins in the world, running on over 4 million websites. Recent allegations have surfaced claiming that a recent update introduces a functionality that silently generates WordPress Application Passwords, effectively granting group.one—the parent company that also owns WP Rocket—administrator-level permissions over user websites without explicit user consent.
The mechanism is reportedly triggered the moment an administrator navigating a connected site opens the plugin’s "Help & Support" area. According to security researchers and rival developers, the plugin bypasses standard WordPress authorization protocols, automatically transmitting these high-level credentials to external servers. This allows automated AI agents and third-party infrastructure to potentially act on behalf of the site owner without prior authorization, creating what critics are openly labeling a backdoor.
As the news spreads across social media and developer communities, outrage has reached a fever pitch. Users are reporting deleted forum threads, expressing deep concerns over data privacy and site integrity, and rapidly migrating away from Rank Math to alternative SEO solutions.
Chronology of the Controversy
The unfolding crisis can be traced through a specific timeline of software patches, social media whistleblowing, and community backlash:
Two Days Prior to Disclosure: Rank Math releases version 1.0.277, a routine update intended to patch roughly a dozen security vulnerabilities. Buried within this update is new code located in the file vendor/groupone/wap-client/includes/class-app-password-manager.php.
The Whistleblower Alert: Sybre Waaijer, the lead developer of rival SEO plugin The SEO Framework, publishes a bombshell exposé on X (formerly Twitter). Waaijer points out that the update allows group.one to acquire administrative privileges over millions of WordPress sites silently.
Immediate Community Reaction: WordPress administrators begin checking their user profiles, discovering unrequested Application Passwords labeled WAP — Rank Math Support Agent. Panic and anger erupt across X and independent forums.
Allegations of Censorship: Users attempting to raise the issue on Rank Math’s official support forums report that major discussion threads detailing the vulnerability are systematically deleted by moderators.
Mass Migrations: Site owners begin advising peers to audit their user lists and completely uninstall Rank Math, marking a significant blow to the plugin’s reputation.
Supporting Data and Technical Breakdown
To understand the gravity of the allegations, it is essential to look at how WordPress Application Passwords are designed to function versus how Rank Math allegedly implements them.
What Are WordPress Application Passwords?
Introduced into WordPress core, Application Passwords are a legitimate feature meant to allow external applications (such as mobile apps or desktop clients) to securely authenticate with a WordPress site via REST API without exposing the user’s primary password. Crucially, they are designed to be:
Individually revocable: Site owners can disable a single integration without changing their core credentials.
Transparently authorized: The WordPress core framework enforces an explicit authorization screen.
The WordPress Core Authorization Flow
According to official WordPress documentation and integration guides, any plugin utilizing Application Passwords must present an authorization screen to the user. This screen must explicitly identify the plugin, outline the requested permissions, and require the user to manually click an "Approve" or "Reject" button. The credential should never be passed to an external server until the user gives explicit consent.
How Rank Math Allegedly Bypass This
According to Waaijer’s technical breakdown, the Rank Math code short-circuits this safeguard:
When an administrator with a free rankmath.com account clicks on "Help & Support", the plugin instantly generates an Application Password tied to that user.
Because the user is an administrator, the generated password inherits full Administrator-level permissions.
The password is immediately packaged and sent to group.one’s servers.
Although a "Terms & Conditions" box may appear in the UI, data transfer reportedly begins before the user can read or interact with the box, rendering opt-in mechanisms functionally useless.
Closing the support tab does not revoke the credential, and the token does not naturally expire.
Official Guidelines and Security Standards
The actions attributed to Rank Math directly clash with established WordPress.org plugin guidelines regarding external server communication and data tracking.
The Explicit Consent Rule
Plugin Guideline Number 7 states:
"In the interest of protecting user privacy, plugins may not contact external servers without explicit and authorized consent. This is commonly done via an ‘opt in’ method, requiring registration with a service or a checkbox within the plugin settings."
By triggering credentials and data transfers upon simply viewing a support tab—without an upfront, mandatory opt-in checkbox and interactive approval screen—Rank Math appears to violate the foundational terms of hosting plugins on the official WordPress repository.
Vulnerability History
This controversy does not exist in a vacuum. Security tracking databases highlight a continuous stream of security challenges for the plugin:
2024: 7 documented vulnerabilities.
2025: 4 documented vulnerabilities.
2026 (Year-to-Date): 3 vulnerabilities, including a recent Unauthenticated Stored Cross-Site Scripting (XSS) issue.
Consequently, Rank Math has consistently failed to meet the rigorous vetting criteria required for inclusion on curated lists, such as Search Engine Journal’s approved WordPress plugin directory, which strictly mandates a clean and trustworthy security record.
Implications for WordPress Site Owners
The discovery of unauthorized administrative credential generation carries profound implications for the broader WordPress ecosystem, affecting security, trust, and platform architecture.
Immediate Action Required for Site Owners
Security experts strongly advise all current and former users of Rank Math to immediately audit their WordPress installations. If your site has ever had Rank Math installed and an administrator accessed the Help & Support section, you may be compromised.
How to check and revoke the access:
Log into your WordPress Dashboard.
Navigate to Users -> Profile (or Edit My Profile).
Scroll down to the Application Passwords section.
Look for any active password starting with WAP — (specifically WAP — Rank Math Support Agent).
Click Revoke immediately.
User Sentiment and Ecosystem Backlash
The community response has been overwhelmingly negative. Prominent community members have voiced severe frustration over what they perceive as corporate overreach and a betrayal of trust.
User @tprinty captured the sentiment on X, writing: "This is horrible. WP needs SEO as part of core."
Meanwhile, user @CAwavehello highlighted the controversial moderation response: "There was a huge thread started on their WP forum page a few days ago and now it magically got deleted. Got the notification today they deleted it after all hell broke loose on their users forum. WTF?!"
Frustrated developers and site owners are now actively seeking alternatives, with many asking for recommendations to migrate their search optimization infrastructure away from Rank Math to more transparent competitors.
Conclusion
As questions mount regarding group.one and Rank Math’s data-handling practices, the incident serves as a stark reminder of the hidden risks associated with third-party plugins in content management systems. Until a transparent, audited patch is released—accompanied by a formal explanation and strict adherence to WordPress core authorization standards—site administrators are urged to exercise extreme caution, revoke suspicious application passwords, and thoroughly audit their plugin dependencies.
