InstantSoft icms2 EUVD-2026-96871

Requires a site running InstantSoft icms2 (version 2.18.2 or earlier) with the Billing Module enabled and PayPal configured as a payment method, since the flaw lives in validatePaypalOrder in system/controllers/billing/actions/paypal.php. The attacker needs a low-privileged account (PR:L) able to initiate a billing/PayPal order, then manipulates the bid/sig arguments to bypass authenticity verification. Limiting factors: exploitation is confined to deployments that actually use the PayPal billing integration, and it needs at least a standard authenticated shop account rather than anonymous access; impact is limited to integrity (fraudulent order acceptance) with no direct confidentiality or availability effect.

This is a genuine-but-moderate priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a remotely reachable, low-complexity flaw requiring only low privileges (PR:L) - consistent with a registered shop/customer account on an icms2 site rather than full anonymity. Impact is limited to integrity (VI:L) with no confidentiality (VC:N) or availability (VA:N) impact, which fits a PayPal order-validation bypass under CWE-345 (insufficient verification of data authenticity): an attacker forges or replays the bid/sig parameters so the billing module accepts an unverified/unpaid order. Exploitation maturity is E:P (proof of concept), and the description confirms the exploit was publicly disclosed, so publicly available exploit code exists. However, there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation - treat it as low-and-slow opportunistic risk against a niche platform, not an urgent mass-exploitation threat. CONFLICT TO NOTE: the input Tag 'Information Disclosure' contradicts the CVSS vector, which shows VC:N (no confidentiality impact) and VI:L (integrity impact) - this is a payment/authenticity bypass, not a disclosure issue; the tag appears mislabeled. The vendor was contacted and did not respond, so no official patch or advisory is confirmed.

An attacker with a low-privileged account on an icms2 store initiates a billing transaction, then crafts or replays the bid/sig parameters sent to validatePaypalOrder in paypal.php so the module treats an unpaid or forged PayPal order as legitimately paid, obtaining goods, services, or account balance without real payment. Because AV:N/AC:L applies, the request is a straightforward remote HTTP interaction requiring no special timing, and a public proof-of-concept exists to reproduce it.