WordPress Plugin GDPR Compliance Remote Code Execution

This strike exploits a remote code execution existing in the WordPress GDPR Compliance plugin. The vulnerability resides in the lack of requests authorization when performing the AJAX wpgdprc process action call as a unauthenticated user, resulting in alteration of database entries. An attacker is thus able to add a privileged user to a WordPress platform and subsequently execute PHP code as the user under which the HTTP server runs.