It is possible for an attacker to potentially compromise your device if you connect to an unsecured public Wi-Fi network.
If you connect to a public Wi-Fi network, your device is essentially on the same network as all the other devices that are also connected to that network.
As has been said by the previous answer your traffic can be listened to, intercepted and modified even when you are on a HTTP or HTTPS-secured site ssl-stripping-attack.
The risk factor becomes more plausible depending on what you are doing:
Are you running a vulnerable service listening on an open port?
Are you browsing using an unpatched browser version?
And there is the possibility of a zero day exploit that can compromise your browser/PC.
Simply using a public or hotel wifi without using a VPN makes your PC more readily available to a bad actor in the same network.
SSL Stripping is an attack that aims to demote the security of an HTTPS secured website by intercepting and altering the communication between a client and a server.
The attack aims to exploit vulnerabilities in SSL/TLS connections, which are used to encrypt and secure communication over the internet.
This could be achieved by downgrading a more secures TLS to an insecure ssl Connection. So an attacker in close proximity in the same network can relay traffic between a user and web server using his own generated certificate and key for decryption.ssl stripping allows the attacker to create a bridge or proxy between the client and server thereby sniffing sensitive info without the users knowledge man-in-the-middle-attack.
Virtual Private Network (VPN)
Virtual Private Network is a network that allows you to create a secured and encrypted connection to another network over the internet. A VPN helps to protect against mitm by encrypting internet traffic of a user over a secured tunnel/channel, which makes it extremely d1ifficult for an attacker to decrypt the data and read the data (which to a second party is gibberish).
A VPN can also help in authenticating to the VPN server using a Digital certificate this help to verify you are connecting to the intended server rather than an insecure server set up by an attacker.