Admin access in Wordpress gives complete control over the Wordpress settings, content, users, etc. (including exporting it all, e.g., via a backup). I believe it also allows execution of arbitrary code as whatever user Wordpress runs under (likely the web server user), e.g., via installing a Wordpress extension.
I believe a Wordpress theme contains of PHP code, though. So (unless you carefully audited the theme) you've already allowed that developer to run arbitrary code on your machine. Of course, if this is a publicly-available theme, the risk is lower (as it isn't targeted at you and detection is more likely).
(If you're not confident of running a VM yourself, you can get one relatively cheaply from any of the many cloud providers.)