WordpPress “out of the box” is not GDPR complaint. Even putting aside the integration with non complaint services like akismet and gravatar, just storing comments will probably require to give users the ability to delete them, but there is no real way to identify which users created which comment as comment authors are never verified.
For 99% of wordpress sites this is going to be a non issue, and in general, unless you are already a subscriber to letters from the various EU regulatory bodies, it will take time until GDPR will become something for which the DOs and DON’Ts become clear.
DISCLAIMER The point of this answer is to highlight few areas which are likely to need some thinking in the GDPR context, but I am far from being an expert, and this is not an advice on what is it that you should do with your site. If GDPR compliance is important for you, you should consult an expert to understand what it means for your specific site.