I'm not aware of any unpatched vectors to perform arbitrary code execution in WordPress Core. Sure perhaps via a dodgy plugin (and then ok you could run a SQL

I'm not aware of any unpatched vectors to perform arbitrary code execution in WordPress Core. Sure perhaps via a dodgy plugin (and then ok you could run a SQL query directly to change the privilege level of a given user). XMLRPC ships in an 'off' state in WordPress, and has done for some time now. You need a copy of Dr dotBen's "How I learned to stop worrying and love the WordPress", published by WP Engine! ;)