Not all POST requests require a CORS preflight. In particular, "normal" form submissions, like the type that are accessed via $_POST in the article, do not.

Specifically, "simple requests" do not, covered here[1]. This case is POST, with a Content-Type of application/x-www-form-urlencoded. (The rule of thumb you can use is that these were all essentially possible to send prior to CORS even existing. To send a POST, you would construct a form tag with the inputs filled in with the desired values, set the target URL to the "victim" site, and have JS submit the form.)

[1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Simpl...

dns rebinding could make it work, thats not the question