Rank Math plugin accused of secretly granting admin access

Image credit: Search Engine Journal

The Rank Math WordPress plugin is facing accusations of secretly generating administrator-level application passwords for its parent company, Group.one, without obtaining explicit user consent.

This alleged practice could allow Group.one’s AI agent to perform actions on user websites, raising significant security and privacy concerns within the WordPress community.

The issue reportedly arises when a user goes to the plugin’s ‘Help & Support‘ section, triggering the creation of a WordPress Application Password with administrator permissions.

Sybre Waaijer, developer of The SEO Framework plugin, highlighted the alleged vulnerability, pointing to the file ‘vendor/groupone/wap-client/includes/class-app-password-manager.php’ as responsible for the unauthorized password generation.

According to Waaijer, the generated password is subsequently transmitted to Group.one’s servers, a process that reportedly occurs without user notification or explicit consent.

This action would contravene WordPress’s established plugin guidelines concerning external server contact and data collection, according to cybersecurity experts.

Users have expressed negative reactions to the allegations, with some reporting that their complaints were removed from Rank Math’s official forums.

Several users reportedly migrated their websites away from the Rank Math plugin following the disclosure of these claims.

Rank Math has previously encountered security challenges, with reports indicating 7 vulnerabilities in 2024, 4 in 2025, and 3 identified so far in 2026.

Neither Rank Math nor Group.one has publicly addressed the specific allegations regarding the secret creation of administrator passwords.

Source: Search Engine Journal