Description
A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants.
Remediation
References
Related Vulnerabilities
WordPress Cross-Site Scripting Vulnerability (0.70 - 4.1.1)
WordPress Plugin Form Store to DB Unspecified Vulnerability (1.1.0)
WordPress Plugin Database Backup for WordPress 'edit.php' Directory Traversal (1.7)
WordPress Plugin Jetpack-WP Security, Backup, Speed, & Growth Information Disclosure (9.7.1)