Your implementation method leads to security hole. If you allow to upload a zip archive that will be extracted and integrated into the system, that means you give a full control over the server.
If you trust people who will use the system, then fine. But I suggest to install all themes you like and let user only chose one of preinstalled ones.
1. how does the cms read the plugin, as I don't know where to insert my file extractor.
I hope this tutorial will answer your question: http://www.impresspages.org/docs/workin ... form-post/