All the Magento 2 websites based on the latest 2.1.6 and or an earlier version with the disabled «Add Secret Key to URLs» option are vulnerable to DC-2017-04-003 (Remote Code Execution, CSRF))

News
, ,
1

So please ensure the «Add Secret Key to URLs» option is enabled for your website.

«Stores» → «Configuration» → «Advanced» → «Admin»→ «Security» → «Add Secret Key to URLs» → «Yes»: