CakePHP versions 3.2.0 and below suffer from a _method cross site request forgery protection bypass vulnerability. Continue reading...