If you have multiple forms on a page and one of them is ajax, if an ajax request is sent first the csrf cookie will be regenerated once a check is done rendering the static forms (non ajax) invalid.

ICYMI: Five AJAX/API vulnerabilities hit Joomla and WordPress in March 2026. Same root cause every time: endpoints that verify a CSRF token but never check who the user is. Joomla's com_ajax was ...

True, CSRF is not as common nowadays, but it doesn’t mean it’s not harmful to a web app or website. On the contrary, it can cause big problems for your business and your users. The prominent examples ...