I just updated my site to 3.6.4 and in doing some maintenance noticed that there were unauthorized users added to the site to the registered users group. I was able to delete the users without a problem, some were obviously spammers, some with domain name suffixes coming from eastern Europe.
Do I need to worry about what I registered user could do with privilege escalation? should I change all the server passwords? I've read that the 3.6.4 update was specifically to fix a privilege escalation exploit, but what else should I do?