Comment by AlienRobot

I'm not sure I understand. That's the main pre-condition... to include an arbitrary PHP that is already in the server.

On a fresh WP install, a random user can't upload PHP files. Normally you don't even need to allow random users to register an account since avatars on comments come from gravatar anyway.