found out it was this rule:
rewrite ^/(.*).php$ /nothing_404_404?p_hm=qwerty last;
But that way I gain access to all files ending with .php
Solved! adding wp-admin folder to the exception list… which I guess shouldn’t be since the title says admin files are included