Flight PHP’s Request::getMethod() blindly follows the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter on every request, even safe methods like GET. This flaw lets an attacker change a GET request into a DELETE or PUT and thus carry out CSRF attacks that delete or modify resources, or bypass middleware that relies on HTTP verbs. The weakness is classified as CWE‑436 and can be exploited to cause unauthorized destructive actions.

The vulnerability affects the flightphp:core micro‑framework for PHP, all releases older than version 3.18.1. Users relying on older versions of this framework are exposed and should consider upgrading before the patch is available.

The CVSS score of 7.5 indicates a high severity, and the vulnerability is publicly listed in a GitHub advisory. Because the flaw can be triggered via any HTTP request, an attacker can exploit it from outside the network using a crafted request, without authentication. Although the EPSS score is not available, the lack of a KEV listing suggests no confirmed exploitation yet, but the attack vector remains high risk and the impact substantial.