Security notice
Rank Math created admin-level site credentials without a clear ask
Rank Math version 1.0.277 shipped a Support Agent that created a WordPress Application Password when an administrator opened the plugin's Help and Support panel. The credential carried that user's permissions and did not expire. Rank Math paused the feature five days later and accepted that it had not asked clearly enough. No misuse has been reported, but any credential created in that window is still live until somebody revokes it by hand.
What happened
On 26 August 2026, Rank Math released version 1.0.277 of its SEO plugin, which runs on more than four million WordPress sites. The release introduced a Support Agent, an assistant that answers support questions from inside the plugin.
Opening the plugin's Help and Support panel caused it to create a WordPress Application Password named WAP – Rank Math Support Agent. An Application Password is a long-lived API key that carries the full permissions of the account it belongs to, so one created by an administrator is an administrator credential. It did not expire, closing the tab did not remove it, and there was no setting to turn it off.
Sybre Waaijer, who develops a rival SEO plugin, raised it publicly over 28 to 30 August. Search Engine Journal reported it on 30 August. On 31 August, Rank Math shipped 1.0.277.2, which paused the Support Agent, and published a statement accepting that the plugin had not explained clearly enough that credentials were being generated. Their own wording was that when an AI agent is being given permission to create an application password, the site owner should be told clearly and directly what is happening. The feature will return once the flow asks first.
You can read the original report for the full background.
What is established, and what is not
We think this distinction matters, because the story travelled further than the facts did.
Established, because Rank Math confirms it in its own changelog and statement: the credential was created, the consent flow was inadequate, and the feature was withdrawn.
Contested: Rank Math says the credential was encrypted, was not stored or kept on its servers, and that the agent could only read, not change. Waaijer's account differs on where the credential went. Nobody has published an independent audit of the code that settles it, so treat both positions as claims rather than findings.
Not established at all: there is no CVE, no advisory from Wordfence or Patchstack on this behaviour, and no report of anybody's site being altered through one of these credentials. The same 1.0.277 release also fixed roughly a dozen genuine, unrelated vulnerabilities, which is worth separating from the Support Agent question rather than folding into it.
What to do if you run Rank Math
- Update to 1.0.277.2 or later. This stops any new credential being created.
- Check every administrator account, not only your own. The credential was tied to whichever user opened the help panel, so it may sit on a colleague's profile rather than yours.
- Look under Users, then the profile, then Application Passwords. Revoke anything named
WAP – Rank Math Support Agent, or anything else you do not recognise. - Do this even after updating. No source we found states that the update revokes credentials already created, and Rank Math's own statement does not say it does. Assume it does not.
- Across several sites, use WP-CLI.
wp user application-password list <user-id>to see them,wp user application-password delete <user-id> <uuid>to remove one.
Revoking an Application Password cancels API access for that key alone. It does not change the person's login password, and on the evidence so far there is nothing here that calls for a full credential reset.
The pattern worth paying attention to
This is the third case this year where software reached into WordPress sites further than their owners understood.
In late May, SiteGround installed and activated its own AI plugin on more than a million customer sites, having emailed customers beforehand and treating silence as agreement. In August, WPForms Lite was found to hand a temporary administrator token to its vendor's servers during setup, valid for about an hour, which allowed software to be installed on the site. Rank Math is the third.
None of these were break-ins. Each one was a supplier deciding what access it needed and taking it, then adjusting once people objected. For a business owner, that is the harder problem to manage, because there is nothing to patch and no alert to act on. It only surfaces when somebody reads the code.
How we help our clients
If we manage your WordPress site, we will check it for you. Administrator accounts and Application Passwords are part of what we audit, and we will get in touch if we find anything that needs removing.
Sites we build on Jigsaw are not affected, and cannot be. There is no plugin directory, no administrator login and no API for a credential to be issued against, so a supplier cannot grant itself access to a site we have built that way. That is the reasoning behind the platform.
If you run a WordPress site and would like us to check which administrator accounts and Application Passwords exist on it, request a chat and we will take a look.
