Disable access to WordPress DB upgrade script unless user has permission to upgrade core. Place this at the bottom of wp-config.php

gistfile1.php

/** Restrict access to the DB upgrade script **/
if ( 'upgrade.php' == $pagenow ) {
    if ( ! current_user_can( 'update_core' ) ) {
        $url = is_user_logged_in() ? get_admin_url() : add_query_arg( array( 'redirect_to' => get_home_url() . '/wp-admin/upgrade.php' ), get_admin_url() );
        wp_safe_redirect( $url );
        die();
    }   
}