A recent finding shows that Rank Math (a SEO plugin) can create an Application Password that has Admin powers without user consent. Using that password, the application can install and activate plugins from WP.org repo, change settings, create admin users, and edit or delete content. The whole finding is available in this tweet. To prevent this behavior (from any plugin), you can use this snippet code:
// Disable Application Passwords
add_filter( 'wp_is_application_passwords_available', '__return_false', 9999 );Code language: PHP (php)This snippet will disable Application Passwords feature globally.
Just remember to review any apps or workflows that rely on Application Passwords. They may fail to connect to your WP site if you disable this feature.
To list all the Application Passwords of your website by user account, check Admin → Users → Profile, under the Application Passwords section. Or use WP-CLI (with 1 is the User ID):
wp user application-password list 1Code language: Bash (bash)
This is the finding story from Sybre Waaijer (@SybreWaaijer), founder of The SEO Framework plugin:
Two days ago, Rank Math closed about a dozen security issues in 1.0.277. This plugin runs on over 4 million sites.
In that same update, group[.]one (who also owns WP Rocket) now gets administrative privileges to your site.
Last time, I classified something like this as a backdoor. This time, you may decide.
The file: vendor/groupone/wap-client/includes/class-app-password-manager.php.
What it does:
When a site administrator whose site is connected to a (free) rankmath[.]com account opens “Help & Support,” the plugin immediately creates a WordPress Application Password for that user. It sends that password to group[.]one’s servers. Their AI agent can then act on your behalf on your site.The plugin never asks first. There is a “Terms & Conditions” box, but it does not stop the password from being created or sent. The transfer starts before the box even appears.
What they can do with it:
WordPress Application Passwords have no capability scopes; that password gives administrator powers. Their servers can install and activate plugins from WordPress[.]org, change settings, create admin users, and edit or delete content. They cannot immediately log into wp-admin in a browser, but they do not need to.For example, they can install a snippets plugin and then inject PHP into its settings. That is remote code execution. “WPCode — Insert Headers and Footers” by Syed Balkhi exists to do just that. The password group[.]one holds can install it and write those settings.
Will they do this? Probably not. But their servers are now a hot target: they are collecting administrator passwords from a plugin on over 4 million sites. A hacker who gets that pile can hijack every site that already minted one.
The password shows up on your profile as “WAP – Rank Math Support Agent”. Closing the “Help & Support” tab does not revoke it. This Application Password does not expire. You cannot turn the “Support Agent” off.
What you should do:
If you opened “Help & Support” while connected, revoke the Application Passwords immediately.Go to “WP Admin -> Users -> Profile -> Application Passwords, and revoke anything starting with “WAP –”.
Extra context:
I’m the founder of The SEO Framework plugin, a competing plugin to Rank Math, but without CVEs.