In PHP code, you can do anything. So with the plugin, it can do anything as well.
It can also get information or delete anything in the database, run settings, turn off plugins, etc.
Sometimes plugins can take over your server. But it depends on your server settings. Sometimes it can change your password too. Also, some plugins are poorly written, and it will create a security risk to your site.
But when you use some plugin, check the popularity of the plugin. If a lot of users use it, it is safe to download.