In reply to Peter Knight.

What you're describing sounds like a scenario in which malicious code has access to a logged in instance of an admin account. Code editor or not, any malicious code will be able to do some damage with that much access. It does sound like an uncommon attack vector to me, I'm not aware of any major security breaches involving the code editor in that way. Any WP security experts willing to shed some light on that?