Rank Math, an SEO plugin on more than four million WordPress sites, stands accused of quietly creating an admin-level credential for its maker. For the many Australian businesses on WordPress, that is a commercial risk, not a security footnote.
The Take: An SEO plugin running on more than four million websites stands accused of quietly handing its maker administrator access. If you run WordPress, the tool you installed to help Google find you may have handed a stranger the keys to the whole site. For the many Australian businesses on WordPress, that is not a security footnote.
The mechanics: Search Engine Journal reports that when a user opens Rank Math's Help and Support area, the plugin creates a WordPress Application Password that inherits administrator-level permissions. The concern sharpened after Rank Math's 26 August 2026 release added a support agent and new AI features. An application password is not a login you can see in your user list. It is a standing credential that keeps working until someone finds it and revokes it.
The precedent: This is not Rank Math's first difficult month. Search Engine Journal notes the plugin has already had three vulnerabilities disclosed in 2026. Read that line again before you install the next plugin on the strength of a promise. A tool you trust with your search visibility has earned a closer look, not a faster tick.
Websites running Rank Math, the SEO plugin accused of granting itself admin access
The fine print: WordPress powers the majority of small business websites in Australia, where only about 41% of Australian small businesses have a website at all. For the ones that do, the site is often the sales channel, the booking system and the customer list in one place. On that stack, handing a plugin vendor silent admin rights puts all three in someone else's reach.
For Australian operators: Open your WordPress users and application passwords today and revoke anything you do not recognise. Audit which plugins hold admin-level access, remove the ones you are not actively using and switch on alerts for new admin accounts. A plugin earns trust by needing the least access to do its job, not the most. A vendor that grants itself the keys quietly has just written your review for you. Set a standing reminder to check plugin permissions the same way you check who still holds a key to the office.