Request Approval to add new Plugins

// Prevent new plugin installations but allow updates to existing plugins

add_filter('user_has_cap', 'prevent_plugin_installation_for_all_users', 10, 4);

function prevent_plugin_installation_for_all_users($allcaps, $cap, $args, $user) {

    // Prevent plugin installation for all users

    if (isset($args[0]) && $args[0] === 'install_plugins') {

        $allcaps[$cap[0]] = false;

    }

    // Allow plugin updates and activation for all users

    if (isset($args[0]) && in_array($args[0], ['update_plugins', 'activate_plugins'])) {

        $allcaps[$cap[0]] = true;

    }

    return $allcaps;

}

// Prevent plugin installations via WordPress REST API

add_filter('rest_pre_dispatch', 'block_plugin_installation_via_api', 10, 3);

function block_plugin_installation_via_api($result, $server, $request) {

    // Block installation if it's an API request to install a plugin

    if ($request->get_route() === '/wp/v2/plugins' && $request->get_method() === 'POST') {

        return new WP_Error('plugin_install_blocked', 'Plugin installation is disabled.', array('status' => 403));

    }

    return $result;

}

// Hook into the plugin upload page to hide the "Add New" button

add_action('admin_menu', 'remove_add_new_plugin_menu');

function remove_add_new_plugin_menu() {

    global $submenu;

    if (isset($submenu['plugins.php'])) {

        foreach ($submenu['plugins.php'] as $key => $item) {

            if ($item[2] === 'plugin-install.php') {

                unset($submenu['plugins.php'][$key]); // Remove "Add New" option from Plugins menu

            }

        }

    }

}