SEO Recap covering August 30, 2026: Rank Math accused of taking silent admin access

Built by Stephanie Chung·2 min read·1 story

Daily summary of what matters in SEO, GEO, AEO, and AI search generated with Claude Code (beware of hallucinations)

Technical SEO

Sybre Waaijer, developer of The SEO Framework, alleges that Rank Math version 1.0.277 creates a WordPress Application Password when a site administrator connected to a free rankmath.com account opens the plugin's Help & Support section, then sends that password to group.one's servers so its AI agent can act on the site.
Because the credential inherits the permission level of the logged-in user, an administrator triggers an Administrator-level password. The transfer starts before the Terms & Conditions box even appears, which Waaijer says violates WordPress guidelines requiring explicit opt-in consent before contacting external servers.
The generated password appears on the user profile as "WAP - Rank Math Support Agent", does not expire, cannot be turned off, and is not revoked by closing the Help & Support tab. Waaijer advises anyone affected to go to WP Admin, Users, Profile, Application Passwords and revoke anything starting with "WAP -".
The plugin runs on over 4 million sites. Users reported that a Rank Math forum thread on the issue was deleted, and some said they are moving away from the plugin.
Search Engine Journal notes Rank Math had 7 vulnerabilities in 2024, 4 in 2025, and 3 so far in 2026, including a recent unauthenticated stored cross-site scripting flaw, and recommends running a security check on all installed plugins.

Published on September 1, 2026