Compromised Wordpress Admin account risk

I am wondering what are the risks of a compromised Wordpress Admin account.

Can the Wordpress Admin user cause any risk to the platform running the wordpress? For example, can the admin gain access to OS or database? If on the same platform, other applications are being run, can the compromised admin cause any issue to other applications?

(I can imagine the hacker would have full control over the website content and look, users account, and can install new plugins that leave a backdoor to come back. But any other risk beyond the wordpress site itself?)