Question: Our Wordpress website was hacked. I couldn't find anything intelligible from my limited experience from the limited logs my hosting gives. However, browsing in the FTP files I found a post.php file in the root and two more themes. Nothing strange in the DB, nor a new user. In the index I found the string "Silence is golden".

I spent my day reading about it and it seems one of the most classic WP attacks. 

The server hosts a directory of the root where there is a form powered by AppGini, which relies on another DB and is loaded in an iframe in the Wordpress pages. This form is not password protected, however AppGini ships by default protection of MySQL injection.

In your opinion, could this form be the door to enter the WP installation? Is this technically possible? Or is it a 100% Wordpress attack, regardless of what is beside it?

Answer: 
Sure, if there is a PHP script which allows code execution - eg via command injection, file upload, etc - on the same server then an attacker can use that to gain access to the WordPress installation. The same is true for directory traversal vulnerabilities. (Assuming that you do not take any measure to separate different applications such as different virtual machines)

If a separate script contains an SQL injection, that could also lead to access to WordPress, depending on the setup of the database permissions. If the script is on the same domain, XSS could also be exploited. 

I'm not familiar with AppGini, and I do not know what kind of form you are using, but as it is some kind of development/code generation tool with a browser-based administration GUI, any form really should be password protected. We can't tell you how an attacker gained access (@K BHATTs answer covers the most common issues), but this also seems like a likely attack vector.

"Silence is golden" index.php files are from WordPress. They are not a sign of anything, they are just there to prevent directory listing.
The best practise to put in place is to ensure that your wordpress and its plugins are updated at a regular interval , i prefer to check for update every 10 days. Given the scenario there do not seem to be any APPgini based exploits available publically and my guess would be a vulnerability in the plugins that might have been installed. Also i suggest if there are a limited people accessing the panel make use of a 2FA. 

Coming to the point , this could be a wordpress plugin exploit.
An exact guess cannot be given because i dont know what plugins and what version were installed on your wordpress. But yes , there are reverse shell php scripts available through which a limited shell access can be obtained.