Just to continue few important things on the excellent answer @MarkKaplun provided that should be accepted.
disable-functions
is PHP world.
Here is the more broad list:
exec, passthru, shell_exec, system, proc_open, popen, show_source, apache_child_terminate, apache_get_modules, apache_get_version, apache_getenv, apache_note, apache_setenv, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid, posix_getpwuid, posix_uname, pclose, dl, disk_free_space, diskfreespace, disk_total_space, pcntl_exec, proc_close, proc_get_status, proc_nice, proc_terminate, symlink, link, putenv, opcache_get_configuration, opcache_get_status
This is a PHP directive you may set in the php.ini file.
You don’t specify WordPress functions in there. The comma separated functions you enter will be accepted whenever the PHP interpreter runs or when PHP jit runs (hhvm), these functions will be disabled.
One more thing to cover is the process under which PHP is running.
Even though you may have mighty functions in PHP they can do nothing if the process under which PHP executes doesn’t have the access rights to do these things.
So the security perspective would be to create an isle. Let your www-data user live only on that isle. Let’s say the isle is the /var/www folder.
From the /etc/passwd you can check the details about the www-data user. By default it should be like this:
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
Use the chmod and chown to create the isle or the level of isolation you need.