In reply to Ashutosh Mishra.

your plugin code could become a back door even if not activated :

https://example.com/wp-content/plugins/inactiveplugin/somecode.php