On a fresh WP install, a random user can't upload PHP files. Normally you don't even need to allow random users to register an account since avatars on comments come from gravatar anyway.
Indeed, but you don't need to upload anything as long as there's already a PHP file that allows you to execute arbitrary commands somewhere on the server, right?
Well, as it turns out, the default PHP Docker image has had such a file readily available until version 8.5 =)
- especially the functions that are explicitely exposed to be used on front-facing interfaces (ie: templating functions).
- and especially when the security flaw in question was not only raised 9 years ago but described in details on the official documentation page of the affected function