The simplest CSRF vector would look something like this:
Then you just need to get this bit of HTML in front of the victim. However this will generate a GET request. If the endpoint uses POST you could try something like (example only - not tested):
<form action="https://firstname.lastname@example.org&amount=10000" method="POST" onload="this.submit()">
- If the server has misconfigured CORS that responds to the browser and allows all domains in the wrong way, your DELETE request will fire anyway
In short, this would only be vulnerable in the light of additional misconfigurations. It still isn't a great idea, because someone down the line may decide to convert all DELETE requests into POST requests, and forget to add the CSRF check, but it is probably safe as-is.