CVE-2026-108568

Name of the Vulnerable Software and Affected Versions InstantSoft icms2 versions prior to 2.18.2

Description An issue exists in the Billing Module within the validatePaypalOrder() function located in the system/controllers/billing/actions/paypal.php file. A remote attacker can manipulate the bid/sig arguments, leading to insufficient verification of data authenticity.

Recommendations As a temporary workaround, restrict access to the validatePaypalOrder() function until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.