Two days ago, Rank Math closed about a dozen security issues in 1.0.277. This plugin runs on over 4 million sites. In that same update, group[.]one (who also owns WP Rocket) now gets administrative privileges to your site. Last time, I classified something like this as a backdoor. This time, you may decide. The file: vendor/groupone/wap-client/includes/class-app-password-manager.php. What it does: When a site administrator whose site is connected to a (free) rankmath[.]com account opens "Help & Support," the plugin immediately creates a WordPress Application Password for that user. It sends that password to group[.]one's servers. Their AI agent can then act on your behalf on your site. The plugin never asks first. There is a "Terms & Conditions" box, but it does not stop the password from being created or sent. The transfer starts before the box even appears. What they can do with it: WordPress Application Passwords have no capability scopes; that password gives administrator powers. Their servers can install and activate plugins from WordPress[.]org, change settings, create admin users, and edit or delete content. They cannot immediately log into wp-admin in a browser, but they do not need to. For example, they can install a snippets plugin and then inject PHP into its settings. That is remote code execution. "WPCode — Insert Headers and Footers" by Syed Balkhi exists to do just that. The password group[.]one holds can install it and write those settings. Will they do this? Probably not. But their servers are now a hot target: they are collecting administrator passwords from a plugin on over 4 million sites. A hacker who gets that pile can hijack every site that already minted one. The password shows up on your profile as "WAP – Rank Math Support Agent". Closing the "Help & Support" tab does not revoke it. This Application Password does not expire. You cannot turn the "Support Agent" off. What you should do: If you opened "Help & Support" while connected, revoke the Application Passwords immediately. Go to "WP Admin -> Users -> Profile -> Application Passwords, and revoke anything starting with "WAP –". Extra context: I'm the founder of The SEO Framework plugin, a competing plugin to Rank Math, but without CVEs.