By default WordPress allows site administrators to edit PHP files of plugins and themes direct from WordPress admin area dashboard. If you are using this feature from backend then make sure you have a strong security plugins installed in your WordPress site because this functionality can create a major security issue. For example: If your admin password is hacked by a bot or something then they can easily add their malware or suspicious scripts in your site’s themes and plugins easily by editing their PHP files.
