Suppose you are signed in to an application and open another site in a second tab. That site quietly sends a request to your application. The browser adds your session data by itself, because it always does. To the application it looks as though you triggered the action.
That is cross-site request forgery: a request somebody slipped in. The attack needs no stolen password. It is enough that you are signed in.
How the protection works, and how it gets lost
The defence is unremarkable. The application puts a one-off marker into every form and accepts only requests that bring it along. Another site cannot know it. Laravel does this by default, with nothing to set up.
The protection is nearly always lost the same way. While connecting an interface, a call fails, somebody exempts the path from the check so that work can continue, and the exception is drawn more generously than necessary. After that it stops being noticeable, because nothing is broken. Exceptions exactly like these are what we look for in a code audit.