The Elegant Themes Bloom plugin prior to 1.1.1 for WordPress has privilege escalation.
elegantthemes monarch