CVE-2026-108568: Insufficient Verification of Data Authenticity in InstantSoft icms2

The vulnerability exists in InstantSoft icms2 up to version 2.18.2 in the validatePaypalOrder function of the billing module's paypal.php controller. An attacker can manipulate the bid/sig argument to bypass proper verification of data authenticity, potentially allowing unauthorized actions related to PayPal order validation. The attack vector is remote with low attack complexity and no user interaction required. The vendor was notified but did not respond, and no patch or remediation is currently available.

Exploitation of this vulnerability could allow an attacker to bypass data authenticity checks in PayPal order validation, potentially leading to unauthorized billing actions or manipulation of payment processing. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor for official updates. Until a patch is available, consider implementing additional validation or monitoring around PayPal order processing to detect anomalies.