This vulnerability (CWE-502) in Team Yoast Custom field finder allows deserialization of untrusted data, which can lead to partial compromise of confidentiality and integrity. The affected versions include all versions up to 0.3. The CVSS 3.1 base score is 5.4 (medium), with network attack vector, high attack complexity, no privileges required, no user interaction, and a scope change. No patch or official remediation has been published yet.

Successful exploitation could lead to limited confidentiality and integrity impacts. There is no indication of availability impact. The attack complexity is high, and no privileges or user interaction are required, but the scope is changed, indicating some level of impact beyond the vulnerable component. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific mitigations or workarounds have been provided by the vendor at this time.