It was the WordPress permalink structure that screwed this up. By using custom permalinks (%postname%) I could not access any .php-file outside of Wordpress directly.
Setting permalinks to standard, now the server finds the file. Error now changed to 403.1 though...