There is a new kind of WordPress security issue that deserves a lot more attention.
It isn’t simply a case of a hacker discovering a vulnerability in a plugin.
It is a plugin itself introducing a mechanism that can give an outside service or AI system the ability to act on your WordPress site.
And two major WordPress plugins have recently put this issue in the spotlight: Rank Math and WPForms.
The situations are not identical, and it would be wrong to pretend they are. But they point toward the same larger question:
How much control should a WordPress plugin be allowed to hand over to an outside service or AI agent – and how clearly is the site owner told about it?
That question became particularly urgent after Rank Math’s August 26, 2026 release, which added a Support Agent and new AI capabilities.
WPForms: the onboarding wizard controversy
The first controversy involved WPForms Lite 2.0.0, the WordPress forms plugin from WPForms, part of the Awesome Motive family, released July 14, 2026.
The release added a new Onboarding Wizard and Setup Checklist, along with built-in Form Analytics and an AI chat assistant for analyzing form data.
The onboarding system attracted the attention of security researcher Sybre Waaijer, who alleged that WPForms Lite had introduced a backdoor-like mechanism that could give WPForms’ external infrastructure administrative access to a site.
The specific code he pointed to was:
wpforms-lite/src/SetupWizard/Bridge.php
According to Waaijer’s analysis, during setup the administrator’s browser could be sent to an application hosted on WPForms’ servers, with a temporary login token for the WordPress site.
Search Engine Journal subsequently installed and tested the plugin after the allegation was made. Its investigation confirmed that the onboarding process moved the user into an application hosted on WPForms’ servers. The reporter also found that the setup process required two additional plugins to be installed and that the user could end up on the external WPForms application without realizing they had left their WordPress site.
The issue isn’t simply:
“WPForms talks to its own servers.”
Plugins do that all the time.
The questions are:
What authority does the remote system receive? How is that authority obtained? And does the administrator understand what is happening?
A temporary administrator token is still powerful
The token described in Waaijer’s allegation was temporary, reportedly expiring after approximately one hour.
That’s certainly different from creating a permanent credential. But a powerful administrative token can still be extremely consequential while it is valid.
WordPress administrators can perform actions such as installing and activating plugins. And plugins execute PHP code.
So the important question isn’t simply:
“Is the token permanent?”
It is:
“What can the holder of the token do while it is valid?”
A one-hour master key is still a master key.
WPForms’ onboarding experience changed
WPForms 2.0.0 was released July 14, followed by several updates during August, including versions 2.0.0.3, 2.0.0.4, 2.0.0.5 and 2.0.1.
The official changelog includes fixes involving the onboarding wizard, including an onboarding timeout issue in 2.0.0.4.
The onboarding flow also changed in later versions. A notice was added making it clear that users would be transferred to a WPForms.com site to complete setup.
That is significant because one of the issues raised about the original onboarding flow was that the transition from the WordPress administration area to WPForms’ external application was not sufficiently obvious to the user.
Then Rank Math introduced a different kind of access
The Rank Math situation is newer and involves a different mechanism.
On August 26, Rank Math, the WordPress SEO plugin, released version 1.0.277.
The official WordPress.org changelog says the update added a Support Agent that answers support questions directly from the plugin and added abilities for AI assistants to configure Rank Math settings. The same release also included several security fixes credited to researchers who reported issues responsibly.
That sounds like a useful feature.
But security researcher Sybre Waaijer examined the implementation and raised an alarm about what happens behind that support interface.
The component he identified is:
vendor/groupone/wap-client/includes/class-app-password-manager.php
The concern is that, under the relevant circumstances, opening Rank Math’s Help & Support interface can create a WordPress Application Password associated with an administrator.
The credential appears as:
WAP – Rank Math Support Agent
And that is considerably more significant than simply sending a support question to Rank Math.
Why an Application Password matters
WordPress Application Passwords are a legitimate WordPress feature. They allow applications to authenticate to WordPress without requiring the user’s normal password.
That’s useful.
But an Application Password isn’t the same as a narrowly scoped permission such as:
“This application can change my Rank Math title settings.”
An Application Password authenticates as the WordPress user to whom it belongs.
So if the Application Password belongs to an administrator, the application using that credential can potentially operate with that administrator’s authority.
That’s why the Rank Math mechanism has attracted so much attention.
The issue isn’t simply AI.
It is administrator authentication.
The controversial part: Help & Support
According to Waaijer’s analysis, the Application Password can be created when an administrator opens Rank Math’s Help & Support interface while the site is connected to a free Rank Math account.
That raises an uncomfortable question:
Did the administrator knowingly authorize another system to authenticate to the website as an administrator?
That’s very different from clicking a button that says:
“Give Rank Math Support Agent administrator access to this site.”
The latter is an explicit authorization decision.
The former can look like opening a normal support interface.
That difference is at the center of the controversy.
The credential doesn’t simply disappear when you close the window
Another important detail is persistence.
According to the researcher’s analysis, the Application Password remains associated with the administrator account until it is revoked.
So this isn’t simply a temporary connection that disappears when the Help & Support window is closed.
It creates an actual WordPress Application Password.
Why the word “backdoor” is so controversial
This is where the terminology gets messy.
Calling something a backdoor can imply that malicious code was deliberately planted to provide secret access.
That is not something the available evidence establishes about either company.
The WPForms mechanism was presented as part of an onboarding and setup system. The Rank Math mechanism was introduced as part of a support/AI feature.
That doesn’t make the security implications disappear.
A feature can have a legitimate purpose and still create an access path that deserves serious scrutiny.
If an external service has credentials capable of authenticating with administrator-level authority, the important question isn’t what someone chooses to call it.
The important question is:
What happens if that credential or the infrastructure holding it is compromised?
The bigger risk: your security now depends on another company’s infrastructure
This is where the issue gets bigger than either plugin.
When a plugin runs entirely on your server, you’re already trusting its code.
But when that plugin creates a remote connection with an outside service, another security boundary is introduced.
Now you may also be trusting:
- the developer’s external servers
- its authentication system
- how credentials are stored and protected
- who can access those systems
- how access is revoked
- and, increasingly, AI systems operating through those connections
We’ve already seen why that broader trust boundary matters. In the 2026 OptinMonster and ShapedPlugin supply-chain attacks, attackers targeted the infrastructure behind WordPress software rather than simply exploiting an individual website.
An attacker doesn’t necessarily have to compromise millions of WordPress websites individually.
A centralized system that can authenticate to many websites can itself become an attractive target.
Rank Math’s scale makes this particularly noteworthy. WordPress.org currently lists Rank Math with more than 4 million active installations.
That does not mean more than 4 million websites have automatically created the Support Agent credential. The relevant conditions still matter.
But it demonstrates why centralized credentials associated with a hugely popular plugin deserve serious scrutiny.
WPForms and Rank Math are not the same incident
It is important not to lump these together.
With WPForms, the controversy centered on the onboarding process and the alleged use of a temporary administrative token to connect the WordPress site with an external WPForms application.
With Rank Math, the controversy centers on the Support Agent and the creation of a WordPress Application Password associated with an administrator.
The WPForms token was temporary.
The Rank Math Application Password can persist until revoked.
There is also an instructive contrast in WPForms’ separate AI/MCP system. Its documentation says write access is off by default. An administrator must explicitly enable the Enable MCP Write Access option before the AI assistant can use the write capabilities. WPForms also says those write abilities are limited to specific form operations and continue to use WPForms’ existing permission checks.
That’s a materially more explicit permission model.
There is a significant difference between:
The software has this capability.
and:
The software has this capability, but the administrator has to deliberately turn it on.
That distinction matters.
AI is changing what a WordPress plugin can do
This is the part that goes beyond these two plugins.
WordPress plugins have traditionally been pieces of software that add functionality to a website.
Now they’re increasingly becoming bridges between websites and AI agents.
An AI assistant that can merely read information is one thing.
An AI assistant that can change settings, create things, modify content or otherwise act on a website is something else.
It means permissions matter more.
Once a plugin can hand an AI system the ability to make changes, access control becomes just as important as the AI feature itself.
The more authority an agent receives, the more important least-privilege access becomes.
And this is why AI-powered plugins need to be evaluated partly as access-control systems, not just as plugins with an AI feature attached.
“Just update your plugins” isn’t enough anymore
Keeping WordPress and its plugins updated is still essential.
But there’s another step that is becoming increasingly important:
Look at what the update actually adds.
A security update might fix a vulnerability.
A feature update might introduce an entirely new relationship between your website and an outside service.
Rank Math 1.0.277 added the Support Agent and AI configuration capabilities.
WPForms 2.0.0 introduced a new onboarding system, Form Analytics and an AI chat assistant.
Those aren’t merely cosmetic changes. They change what the software does.
Before enabling a new AI, support, connection or remote-management feature, ask:
Does this feature create a credential?
Does it send information to an outside server?
Can the outside service make changes to my site?
What level of WordPress permissions does it receive?
Is access temporary or persistent?
Did I explicitly authorize it?
Can I revoke it?
These questions are going to become increasingly important as software moves from simply providing information to actually taking actions on a website.
This is also why website security can’t be reduced to installing a security plugin. We’ve looked at the limitations of that approach in more detail in The Hidden Cost of WordPress Security: Why Security Plugins Aren’t the Whole Answer.
What should Rank Math users do?
If you use Rank Math, check your administrator account’s Application Passwords, particularly if you opened the relevant Help & Support interface after the Support Agent was introduced.
Look under:
WP Admin → Users → Profile → Application Passwords
If you find the Rank Math Support Agent credential and don’t want it, revoke it.
Also keep Rank Math updated. Rank Math released follow-up version 1.0.277.1 shortly after 1.0.277. WordPress.org lists 1.0.277.1 as August 27, 2026, and says the release fixed an issue involving the Help & Support AI Assistant and Application Passwords when Application Passwords had been disabled.
The point isn’t to panic.
It’s to know what access exists on your site and remove access you don’t want.
What should WPForms users do?
If you use WPForms Lite, make sure you’re running a current version.
The plugin’s official changelog shows multiple updates to the 2.0.x series during August, including fixes involving the onboarding wizard.
Also pay attention when a plugin’s setup process moves you to an external website.
You should know when it happens and understand what the external service is being allowed to do.
If you use WPForms’ separate AI/MCP functionality, the documented write-access control is much more explicit: MCP write access is off by default and must be enabled by the administrator. WPForms says that while write access is disabled, the write tools aren’t exposed to the AI assistant; when enabled, the available abilities are limited and use WPForms’ existing capability checks.
That’s the sort of permission boundary site owners should look for.
Tired of AI being built into everything on your website?
Not every website needs an AI agent.
And not every website owner wants one connected to the systems running their site.
If your priority is direct control over your website, there’s another approach: use website software that gives you extensive built-in functionality without requiring you to assemble your site around an ever-growing collection of third-party plugins and add-ons.
That’s one of the ideas behind UltimateWB.
UltimateWB is a downloadable website builder designed to give you extensive control over your website’s design, functionality and content. You can host your website on UltimateWB servers, or on the server of your choice, both ways allowing you to access your website files, database and hosting environment. Alternatively, you can choose to use UltimateWB Cloud, which couples the website builder and the hosting together like a SaaS hosted website builder – except, the good thing here is that you can choose to upgrade to the downloadable version when you want.
Instead of relying on a long chain of plugins to add basic website capabilities, UltimateWB includes a wide range of functionality directly in the platform, including e-commerce, forums, memberships, galleries, directories, classifieds, SEO tools and more.
If you’re tired of every new website feature turning into another plugin, cloud service or AI connection, take a look at UltimateWB.
Related: Looking for a Website Builder Without AI? Which One Should You Choose?
The bigger lesson for WordPress users
The important change isn’t simply that WordPress plugins now have AI features.
It’s that some plugins are becoming gateways through which outside systems can interact with your website.
Plugins connect to cloud services.
Cloud services connect to websites.
AI assistants connect to plugins.
And those connections can require credentials powerful enough to make real changes.
It can also create a security problem that many website owners aren’t accustomed to thinking about.
For years, the question was:
“Is this plugin vulnerable?”
Increasingly, another question needs to be asked:
“Who else can access or operate my website because I installed this plugin?”
That’s the more consequential question.
The word “backdoor” will continue to be debated in cases like these. Intent will be debated. Implementation details will be debated.
But one thing shouldn’t be controversial:
A WordPress site owner should know when a plugin creates an authentication path to an outside service, what that path can do, and how to shut it off.
Your administrator account can represent control over your entire website.
That makes any mechanism capable of acting as that administrator worth understanding before you click Connect, Enable, Help & Support, or Setup.
And as AI agents become more capable of acting on websites rather than merely talking about them, one question is becoming increasingly important:
Who, exactly, has the keys to your WordPress site?
Looking for a website builder that helps you avoid plugin headaches? Learn more about UltimateWB! We also offer web design packages if you would like your website designed and built for you.
Got a techy/website question? Whether it’s about UltimateWB or another website builder, web hosting, or other aspects of websites, just send in your question in the “Ask David!” form. We will email you when the answer is posted on the UltimateWB “Ask David!” section.