A one-hour master key is still a master key: WPForms, Rank Math, and the pattern underneath
Rank Math’s public changelog for version 1.0.277.1, dated August 27, 2026, reads in full: “Fixed the Help & Support AI Assistant incorrectly showing an HTTPS-required notice on every admin page, even on HTTPS sites when Application Passwords were disabled by another plugin.”
That is a notice bug. Four days later, version 1.0.277.2, dated August 31, said something different: “Temporarily paused the Support Agent introduced in 1.0.277 while we add further transparency to how it requests site access.”
Between those two entries sits a problem that is not unique to Rank Math, and if you ship a plugin with a Help or Support screen it is already your problem too. Six weeks earlier, a plugin with more installs still shipped its own answer to the same problem: a support agent has to be inside the customer’s site, and WordPress ships no standard way to ask. Each built an access bridge into its own product. Neither release, as published, described a request the customer got to see and answer.
The changelogs, in order
Everything in this table comes from the two plugins’ own WordPress.org changelogs, except the WPForms release date and token description, which come from UltimateWB’s August 30, 2026 report summarizing developer Sybre Waaijer’s analysis.
| Date | Release | What the public record says |
|---|---|---|
| July 14, 2026 | WPForms Lite 2.0.0 | “Added: New Onboarding Wizard and Setup Checklist page in the WPForms admin menu to guide users through essential configuration steps.” |
| Aug 26, 2026 | Rank Math 1.0.277 | “[HUGE!] Added a Support Agent that answers support questions anytime, directly from the plugin.” and “Added abilities for AI assistants to configure Rank Math’s settings” |
| Aug 27, 2026 | Rank Math 1.0.277.1 | “Fixed the Help & Support AI Assistant incorrectly showing an HTTPS-required notice on every admin page…” |
| Aug 28–30, 2026 | No release | Waaijer’s disclosure; Search Engine Journal reports it on Aug 30 |
| Aug 31, 2026 | Rank Math 1.0.277.2 | “Temporarily paused the Support Agent introduced in 1.0.277 while we add further transparency to how it requests site access.” |
Read the July and August 26 entries as a site owner would. Neither one says a credential will be created. That is the whole of the disclosure most users ever received.
Rank Math’s Support Agent created a credential that did not expire
Rank Math SEO reports 4+ million active installations on WordPress.org. Search Engine Journal, reporting on August 30, 2026, described the behavior this way: “When a site administrator whose site is connected to a (free) rankmath[.]com account opens ‘Help & Support,’ the plugin immediately creates a WordPress Application Password.” It continued: “The password shows up on your profile as ‘WAP – Rank Math Support Agent'” and “This Application Password does not expire. You cannot turn the ‘Support Agent’ off.”
Relevant Audience’s August 31 write-up, by Antonio Fernandez, adds that the credential carries “Administrator level access” and “does not expire, cannot be turned off, and is not revoked by closing the tab.” UltimateWB’s report locates it in the plugin’s bundled code at vendor/groupone/wap-client/includes/class-app-password-manager.php.
Relevant Audience notes that Search Engine Journal’s August 30 article “carries no statement and no denial from Rank Math,” so as of that reporting the company had not spoken publicly. The company’s own August 31 changelog entry, though, is a more useful admission than anything a critic could write: it paused the feature “while we add further transparency to how it requests site access.” That sentence identifies the defect correctly: what was missing was a request the customer could answer.
WPForms Lite 2.0.0, on thinner sourcing
WPForms Lite reports 5+ million active installations. Its 2.0.0 changelog entry describes the onboarding wizard and nothing else.
Here the sourcing gets thinner. UltimateWB reports that “according to Waaijer’s analysis, during setup the administrator’s browser could be sent to an application hosted on WPForms’ servers, with a temporary login token for the WordPress site,” and that “the token described in Waaijer’s allegation was temporary, reportedly expiring after approximately one hour,” located in wpforms-lite/src/SetupWizard/Bridge.php. Those are hedged descriptions of a third party’s analysis, and this piece will not un-hedge them.
UltimateWB also reports the remedy: “A notice was added making it clear that users would be transferred to a WPForms.com site to complete setup.” That is a real improvement, and faster than the alternative. The public changelog entries for the follow-up releases (2.0.0.1 and 2.0.0.2 on a Cloudflare firewall issue, 2.0.0.3 on currencies and export permissions) do not describe the notice, so a user reading only the changelog would not learn it had been added.
Credit where it’s due. Both of these are public because a developer, Sybre Waaijer, read the shipped code and published what he found; Search Engine Journal, Relevant Audience and UltimateWB each credit him as the source. Nothing here is a claim about either company’s intent, only about what their releases did and what the public record says about them.
Expiry, scope and a record, applied to both releases
Three questions apply to any support-access mechanism: whether the access expires, what it can do while it lives, and whether there is a record the site owner would find. Applying them to these two produces a ranking rather than a shared verdict.
| Rank Math 1.0.277 | WPForms Lite 2.0.0 | |
|---|---|---|
| Does it expire? | No, per SEJ: “This Application Password does not expire.” | Yes, per UltimateWB, which reports Waaijer’s analysis as “approximately one hour” |
| Is it scoped? | No, per Relevant Audience: “Administrator level access” | Not stated anywhere public. The sourcing describes “a temporary login token for the WordPress site” and does not name a role |
| Is there a record the owner would find? | The credential appears under Users, then Profile, then Application Passwords, as “WAP – Rank Math Support Agent” | Not described in any of the sourcing |
| Was it disclosed before it happened? | Not per the changelog or the reporting | Not initially; a notice was added afterward per UltimateWB |
| Time from disclosure to a shipped change | Aug 28–30 disclosure, then an Aug 31 pause, per the changelog | Not dated in the public sourcing; UltimateWB reports the notice was added |
WPForms comes out ahead on expiry, and an expiry is worth having. Where the row goes blank is scope, and that is the sentence in the title. The company, the researcher’s summarized analysis and the changelog are all silent on what the WPForms token could do, and a credential whose capabilities are undocumented is an unmeasured one rather than a scoped one. That distinction is the whole argument: an hour bounds how long a mistake stays exploitable and says nothing about how much the credential could do while it was alive. If the answer is “whatever the administrator could do,” the hour made the access briefer without making it smaller.
Core ships the primitive and none of the guarantees
Both of these are stories about something WordPress does not ship.
WordPress core ships Application Passwords, added in version 5.6, December 2020, as a general-purpose authentication primitive for scripts and integrations. Core requires no consent screen before one is created, offers no expiry, and cannot scope a credential below the role of the account it hangs off. Whether a user is asked, and what they’re asked for, is a decision each plugin developer makes alone, in a sprint, alongside forty other decisions.
That is the primitive Rank Math’s feature was built on, per the code path UltimateWB names. What WPForms built is described publicly only as a login token, so treat the mechanisms as different and the gap as the same one: whatever you build, every guarantee a customer would care about (disclosure, scope, expiry, a record) has to be built by hand, by a team whose job that week was shipping an onboarding wizard or an AI assistant. Two companies with several million installs each, real engineering teams, and nothing to gain from making the news arrived at releases with the same missing piece, six weeks apart. That reads as a missing default rather than two lapses in judgment.
The next twelve months make it more common
The AI angle makes it more common rather than less. Rank Math’s own 1.0.277 entry pairs the Support Agent with “abilities for AI assistants to configure Rank Math’s settings,” and UltimateWB reports that WPForms Lite 2.0.0 “added a new Onboarding Wizard and Setup Checklist, along with built-in Form Analytics and an AI chat assistant for analyzing form data.” An agent that acts on a site needs credentials the same way a human support engineer does, and it needs them without a human present to click anything. Every product team adding one is about to make this decision.
The same job, with the consent step kept in
The alternative is a request the customer answers.
Nobody on the vendor’s team has to build that consent step or defend it later; it is the sequence TrustedLogin implements: a Grant Access button placed inside the vendor’s own plugin by our free SDK, on a screen the customer opened deliberately; a real WordPress account created on their site at the role the vendor configured in the SDK, not the account’s own role; deletion on a schedule run by the customer’s own WP-Cron rather than by anything on our servers; a Revoke Access action added to the customer’s Users list and admin toolbar so they can end it early without asking; and a record of who logged in, to which site, and when, on both sides, kept ninety days by default.
Held to its own three questions honestly: it expires, it’s scoped to a role the vendor picks once rather than per grant, and there’s a record. The role and duration being a vendor setting rather than a customer choice is a real limitation.
None of that is exotic. It is the job both of these releases were trying to do, with the consent step kept in. We built it because we needed it ourselves, and the teams behind these two releases are not careless: the problem gets solved on a deadline, by whoever is free, in a release whose headline feature is something else.
Check your own product this week
If your plugin or theme has a Help, Support, Connect Account, or AI assistant screen, these checks are worth an hour:
- Grep your own codebase for
WP_Application_Passwords,wp_create_application_password, and any REST or bridge endpoint that mints a session, then ask what a user sees before it runs. - Read your last release’s changelog entry as a customer. If it announces a feature but not the access that feature needs, the disclosure gap is already shipped.
- Ask what the credential could do, not how long it lives. An expiry bounds the window, and only the role bounds what can happen inside it.
The longer version of that argument, and why the Rank Math case is the clearest example of it, is here. The argument for making consent the default, written the week it happened, is here.