If you're running Passster versions before 4.3.6, your content protection is compromised — not through a sophisticated attack, but through the WordPress REST API that comes built into every modern WordPress install. Unauthenticated requests to the standard REST endpoint for any protected post return the full content, title, and excerpt in structured JSON. There's no partial disclosure or fragment reassembly required; the API hands attackers everything Passster was supposed to hide.
The vulnerability isn't a regression introduced in a recent update — it existed for approximately seven years, from when WordPress added the REST API (4.7, circa 2016) through the unpatched versions. The protection model Passster built was designed around frontend theme rendering: shortcodes, template conditionals, and what users see when WordPress loads a page. That logic simply doesn't execute when the REST API serializes post data. The authorization check that works in your theme's single.php never fires during API serialization because the code paths are completely separate.
What you should do: verify your Passster installation is at 4.3.6 or later. If you're on an older version, treat this as an immediate priority despite the low EPSS score — the 0.00316 figure reflects that automated scanners don't easily detect this specific bypass, not that exploitation is rare. A targeted attack against a specific site using this plugin is straightforward: query the REST API endpoint and receive protected content verbatim.
The deeper concern: this is a recurring vulnerability pattern in WordPress content protection plugins. The same gap has appeared with XML-RPC, Gutenberg blocks, and now REST API — always the same failure mode. Frontend-gated content gets exposed through alternate content delivery channels the plugin author didn't audit. The 4.3.6 patch likely added a REST API authorization filter (probably rest_prepare_post or a permissions_check method), but that's a point fix for one channel. If you maintain any plugin that gates content, audit your authorization logic across every content delivery mechanism WordPress provides — not just what your theme renders.