The Dreamer Blog WordPress theme through 1.2 is vulnerable to arbitrary installations due to a missing capability check.