WordPress administrators can edit their themes and plugins files directly from the WordPress backend.

If you site URL is http://example.com/,

Themes Editor URL is: http://example.com/wp-admin/theme-editor.php

Plugins Editor URL is: http://example.com/wp-admin/plugin-editor.php

You can disable the code editor in the WP admin adding this PHP code into your wp-config.php file:

// Disable the themes / plugins editor in WP Admin
define('DISALLOW_FILE_EDIT', true);

For example, you can add it like this:

Now someone try to visit to the theme editor or plugin editor he will see an message like this: