@mariadjohnson0 On Cloudron, the code of all the apps are "read-only". We do this because rolling updates is an important feature of Cloudron. For example, if you change the code of an app, Cloudron cannot know how to update the app.
We followed the same approach for WordPress. The code was read-only. WordPress itself could be extended by installing plugins. When a new WP release comes out, we push an update. We call this "Managed WordPress". This app does not have SFTP access.
However, many users have requested that WordPress code be modifiable. For example, they use WP as the starting point for building web sites. For this case, we created a new app called "Unmanaged WordPress". In this app, the WP code is modifiable. This comes with the restriction that cloudron will not update the WP code by itself. You, the sysadmin, has to track and update WP (using the WP dashboard, for example). This app also has SFTP access.
(You can view the Unmanaged WP, by going to Settings -> Enable Community apps).