There’s no obvious executable payload in the attack but the attackers may be building a collection of websites and biding their time.

via WordPress GDPR compliance plugin hacked — Naked Security