I have 7 sites with WP GDPR Compliance and they were all hacked - new admin users + a few uploaded scripts- All of them had Wordfence premium installed but it didn't stop the attack :(