Disable the Theme and Plugin File Editors

Turns off the built-in Theme File Editor and Plugin File Editor screens, so a hijacked admin account cannot inject code through them.

Code

if ( ! defined( 'DISALLOW_FILE_EDIT' ) ) {
    define( 'DISALLOW_FILE_EDIT', true );
}

This only affects the WordPress core editors under Appearance and Plugins.

Install WPIDE on your WordPress site (it is free) and open Code Snippets.
Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
It is added inactive: review the code and settings, then switch it on.