Form Posts are limited to few content types, and application/json is not one of them. I have however found some CSRFs against POST endpoints that did not care that the request was text/plain