Do WordPress plugins have permissions to delete entire directories? (it’s a Linux based host)
WordPress plugins have permissions to do anything WordPress itself can do. It’s all just code. There’s no permissions model or sandboxing of any kind with plugins.
Plugins and themes can do anything that PHP on your system can do.
Is there a quality control process for plugins before they enter the WordPress official repository?
Yes and no. Generally, we review new plugins for prevention of spam and obvious security problems and the like, but it’s not an extensive review. If a plugin contained code to delete themes, and it is an error of some sort, it’s unlikely that it would be immediately caught before being listed.
Most security problems and spam are generally noticed and kept out, if not before then after. Reports sent to [email protected] are investigated, but quite a lot of the reports sent are false or incorrect in some manner.
See, it’s unlikely that your theme disappearing is intentional behavior by the plugin. So it’s a bug in some fashion. Plugins are not extensively tested. There’s 18,000+ of the things, after all. You have to trust the author of the plugin to some degree.
Or your problem may be unrelated to the plugin. Without specific details on how your theme was removed and the sequence of events and the code that causes it to occur… what you’ve presented is basically hearsay. “I did this and a bunch of bad stuff happened” doesn’t mean that the stuff you did caused the bad stuff to happen. Events in computing systems rarely are cause-effect. Most often they are several minor factors among many interacting systems which lead to an unintended and unexpected result. The weirder the problem (and yours sounds pretty weird), the more likely this is to be the case.
So realistically, instead of questioning the process that led to the circumstances, first you need to be sure that the circumstances are not a special case. A contact form plugin that intentionally deleted themes would get reported pretty quick, no? In such a case the plugin would have been removed. So if it’s unintentional, and it didn’t happen to anybody else, then you’d have to basically prove that it’s the plugin that did it instead of some strange and unusual combination of circumstances which nobody could have predicted. The problem would have to be repeatable. The code causing the problem would need to be identified, and then the problem could be fixed.