Question: Our Wordpress website was hacked. I couldn't find anything intelligible from my limited experience from the limited logs my hosting gives. However, browsing in the FTP files I found a post.php file in the root and two more themes. Nothing strange in the DB, nor a new user. In the index I found the string "Silence is golden".

I spent my day reading about it and it seems one of the most classic WP attacks. 

The server hosts a directory of the root where there is a form powered by AppGini, which relies on another DB and is loaded in an iframe in the Wordpress pages. This form is not password protected, however AppGini ships by default protection of MySQL injection.

In your opinion, could this form be the door to enter the WP installation? Is this technically possible? Or is it a 100% Wordpress attack, regardless of what is beside it?

Answer: 
the entry points for attacker can include: outdated - PHP, themes, plugins, weak passwords, misconfigured php.ini file that can lead to issues.
Please check if any of these have been overlooked.
The best practise to put in place is to ensure that your wordpress and its plugins are updated at a regular interval , i prefer to check for update every 10 days. Given the scenario there do not seem to be any APPgini based exploits available publically and my guess would be a vulnerability in the plugins that might have been installed. Also i suggest if there are a limited people accessing the panel make use of a 2FA. 

Coming to the point , this could be a wordpress plugin exploit.
An exact guess cannot be given because i dont know what plugins and what version were installed on your wordpress. But yes , there are reverse shell php scripts available through which a limited shell access can be obtained.