It means that anyone can write to your folder , so someone can put (by using http PUT method
curl http://myservice --upload-file file.txt)and call a cgi script that delete all your files or do whatever he/she wants.
Your index.php can also be delete by using:
curl -X delete www.yoursite.com/index.php
But these two methods also depend on Apache configuration , which methods you have allowed and which are not allowed. You can see which methods a server allows , by using
curl -I url command
The DELETE method requests that the origin server delete the resource identified by the Request-URI. This method MAY be overridden by human intervention (or other means) on the origin server. The client cannot be guaranteed that the operation has been carried out, even if the status code returned from the origin server indicates that the action has been completed successfully. However, the server SHOULD NOT indicate success unless, at the time the response is given, it intends to delete the resource or move it to an inaccessible location.
A successful response SHOULD be 200 (OK) if the response includes an entity describing the status, 202 (Accepted) if the action has not yet been enacted, or 204 (No Content) if the action has been enacted but the response does not include an entity.