The server is setup correctly, no one should be able to execute php which is not at the root directory of wordpress (if he cares about the site’s security). You can look into the htaccess or other server settings to figure out how it was done and remove it, but -10 for that option.
The form and its server side handling do not make any sense at all. Either replace the form with links to the actual term pages, or use some JS to direct to them