For default/base installs of Wordpress (with the exception of third party plugins) attacking through this vector will be a wasted effort.
The image manager is locked down pretty good at this point from non-authorized users. If the account is comprised or the upload manager is exposed publically it will still be hard to exploit it. As you can see from the source the uploader verifies mime types, checks if it's an image with getimagesize(), sanitizes file names, creates the file name with the extension hard coded based off mimetype, sets default file permissions, embedded data like EXIF information is also sanitized, and the file is re-sampled when it creates the multiple sizes. The way the upload code works you don't get any attack points to the GD image processing library either.
Aside from their protection if it has an image extension the server's mine types are not configured to pipe it through the php-cgi process. Meaning, simply running the image in a browser will not allow it to run the PHP code. You would have to have a PHP script run the code embedded in the image. You likely won't find vulnerabilities in the code base to do this for you. This is universal so you will also have difficulty with other image uploaders if they restrict php file extensions as well.
Overall you are better off finding new, undiscovered, and underestimated vectors of attack. Essentially what you want to do is the equivalent of robbing a bank by going in the front door and trying to get in through the vault door. They expected this and over the years built a pretty good vault door.
