I'm testing an application that sends JWT token in the request body (in JSON) instead of the header. Is it less secure than sending JWT token in the request header (like Authorization header), which is more popular?
The security of JWT is not related to the transmission method, but to the algorithm which creates the JWT.
A JWT token is meant to be public, so be it in a header or as POST data, it really doesn't matter, as the purpose of the token is not to be hidden. That's why it's important not to expose the private key, as only with the valid private key you can generate a valid Signature which will be verified by the server.
Remember that the most common case is that the server generates a new token, provides it to the client, and then the client uses it. If the client-to-server transmission is intercepted and the content of the payload changed, it won't matter because once the server verifies the token, it will deemed it invalid because the Signature will not be expected, as the attacker doesn't have access to the Secret.
For this reason, it's important to verify the token on the server. I have analyzed services which didn't do that, resulting in the compromise of the system. An example, a user could fetch all the private information of other users because the server didn't validate the token, so just crafting a payload with a different user ID was enough to retrieves their content.