The short answer is that such a compromise would give an attacker the capability to do anything that an admin could do. That would likely include:
- Altering theme files
- Installing plugins
- Accessing the (Wordpress) database
Of course, the admin would have the ability to install malicious plugins/files (like a webshell) as well.
But any other risk beyond the wordpress site itself?
It's safe to assume "yes" - that there would be additional risk.
Without going into a huge amount of detail, the damage that could be done would be a product of:
- Your webserver configuration (did you
chroot your web files)?
- The permissions with which the
php executable runs
- How prudent you've been setting file permissions throughout your server. Have you made any important files world-writeable?
Regarding that last point: of course, even if your "important" files aren't world writable, they may very well be world readable.
I'm not trying to self-promote here, but you might want to take a look at this webshell platform I made:
I demo compromising a Wordpress application on YouTube. This gives you a pretty reasonable overview of the kind of trouble an attacker could cause:
Please forgive the low-quality, monotonous video :)
TL;DR: if I had an admin account compromised, I personally would consider the entire system compromised and rebuild it from scratch, were that an option.