Yes, a druid can cast polymorph on themselves.
In case you are wondering whether the caster can only target creatures other than themselves, the Players Handbook addresses that:
Targeting Yourself
If a spell targets a creature of your choice, you can choose yourself, unless the creature must be hostile or specifically a creature other than you. If you are in the area of effect of a spell you cast, you can target yourself.
(Basic Rules, p80, PHB, p204.)
There are some limitations. The new form has to have the type of beast, and, as you noted, the CR needs to be less than or equal to your level. And when you transform you assume all of the game characteristics of the new form except for personality and alignment.
It's probably worth a conversation with your GM about what beasts you can transform in to, and how much you need to know about them. It's probably no big deal to transform into a beast you know, like a cat (assuming your character knows about cats), but your GM might have issues if you want to transform into a sabertooth tiger, for instance, if your character does not know what that creature is.
One concern might be whether you can maintain concentration in the new form. This answer answers that fairly authoritatively.
It's worth noting that polymorph is different in almost every particular from the druidic class feature Wild Shape. Differences include concentration not needed for Wild Shape, CR of target beast, length of time changed, and details of game statistics replaced, among others.
Yes.
This may seem overpowered but there are several drawbacks to the spell:
The target's game statistics, including mental ability scores, are
replaced by the statistics of the chosen beast. It retains its
alignment and personality.
If you transform them into a T-Rex they become an unintelligent beast with an INT score of 2.
The creature is limited in the actions it can perform by the nature of
its new form, and it can't speak, cast spells, or take any other
action that requires hands or speech.
It can't communicate with you while in its new form or use its hands to activate any items, or otherwise perform any task that requires hands or speech.
The target's gear melds into the new form. The creature can't
activate, use, wield, or otherwise benefit from any of its equipment.
It's AC changes to 13 (T-Rex is easy to hit but not easy to kill) making it an easy target from long range. It can't benefit from any magic items it might have or any armor or shields.
Also, the spell requires concentration. This carries two more drawbacks.
If the caster takes damage he or she must make a concentration check to maintain concentration. If it fails, the target reverts form which could potentially put them in a very bad situation, surrounded by enemies and perhaps with low HP (maybe polymorph was cast on the fighter when he was almost out of his own HP).
The other drawback here is the opportunity cost of concentration. The caster can't concentrate on any other spells while he is concentrating on polymorph, which means any other spells available to the caster that require concentration aren't available for the duration. This is a spell list that includes things like hold person, fear, suggestion, haste, slow, wall of fire, web, invisibility, greater invisibility, and levitate, to name only a handful of the concentration spells available to a level 7 wizard.
Consider also that beyond class level 7, there would be even more concentration spells available which might come at a higher opportunity cost than polymorph.
Furthermore, there is also the opportunity cost of learning polymorph. When you first gain access to it at level 7 as a wizard or sorcerer, you have 1 (sorcerer, bard) or 2 (wizard) spell choices available. Druid gets it automatically as they know all their spells -- crazy, right?
As a bard or a sorcerer at that level, you have chosen to forgo all other level 4 spells so that you can transform something into a T-Rex for one hour once a day (maybe more if you spend sorcery points). As a wizard, you have a little more flexibility. In any case, the opportunity cost of choosing this spell over any other spell should come with an appropriate value -- in this case, the ability to temporarily transform someone into a powerful beast and the versatility of being able to transform them into any other less powerful beast.
However, I think you're overlooking the more powerful use of polymorph -- the potential of turning any opponent of yours into a harmless chicken or goat while you take care of the rest of the goons trying to steal your gold. Removing a single powerful enemy from combat is a much better use of your action than creating a powerful ally, when creating a T-Rex leaves the powerful enemy on the table to make attacks against you and your other party members.
Best Answer
Polymorph (4th level) is limited in what it can turn things into.
From the spell text (second paragraph):
A beast is a particular creature type. The creature type is listed in the stat block of a creature. Compare adult red dragon (dragon) with allosaurus(beast).
Other types include fiend, fey, dragon, aberration, celestial, construct, monstrosity, ooze, and humanoid. Unless the creature form chosen is a beast (allosaurus, brown bear, etc) the 4th level polymorph spell won't turn the PC into a dragon. As far as the game is concerned, a dragon is not a beast; a dragon is its own type of creature.
The 9th level spell, True Polymorph, has no such restriction.
Your friend may be confusing the two spells, or may not see the distinction between the two creature types. On a humorous note, @NathanS suggests that the most powerful choices for polymorph (4th level) are Godzilla (T-Rex, CR 8, beast) or King Kong (Giant Ape, CR 7, beast). How does the character, or the player, feel about being polymorphed into one of those magnificent beasts? 😎 The PC would need to be level 8 or 7 (respectively) for that to work.