includes/theme-functions.php in the OneTone theme up to and including 3.0.6 for WordPress allows unauthenticated options changes.
mageewp onetone