WordPress makes it possible to edit theme and plugin files directly in the Administration Screens. While it may look like an easy way to customize
a theme or do a quick change, it’s a dangerous feature. When visiting the theme or plugin editor for the first time, WordPress displays a warning to
make it clear that using such a feature may break the web site by mistake. More importantly, users who have access to this feature can trigger the
execution of any PHP code and may therefore take full control of the WordPress instance. This security risk could be exploited by an attacker who
manages to get access to one of the authorized users. Setting the DISALLOW_FILE_EDIT option to true in
wp-config.php disables this risky feature. The default value is false.
DISALLOW_FILE_EDIT is defined in wp-config.php. DISALLOW_FILE_EDIT is set to true. define( 'DISALLOW_FILE_EDIT', false ); // Noncompliant
define( 'DISALLOW_FILE_EDIT', true );