According to Sybre Waaijer, Rank Math automatically creates a WordPress Application Password when an administrator opens the Help & Support section while the site is connected to a free Rank Math account.
The password is called “WAP – Rank Math Support Agent” and gives Rank Math’s support agent the same permissions as the user it belongs to. If that user is an administrator, this means admin-level access.
The main issue is that Rank Math reportedly does not ask for permission first. The password is created and sent to group.one’s servers before the Terms & Conditions checkbox is even shown. It also does not expire when the support page is closed.
Application Passwords are a normal WordPress feature, but creating one with admin permissions and sending it to an external server without clear consent is not something I would accept from any plugin.
If you use Rank Math and opened its Help & Support section, go to Users → Profile → Application Passwords and check for anything starting with “WAP --”. Revoke it if you did not knowingly authorize it.
For now these are allegations and Rank Math should be given the chance to explain. But if the reported behavior is accurate, this is a serious trust issue.
Source: Sybre Waaijer on X