CVE-2026-96599 — Isotope eCommerce through 2.9.10 Weak Order Identifier Generation
Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. G…
Published: 2026-09-23 · CVSS: 8.2 · CVSS 4.0
Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer information, and purchased files by supplying a guessed uid parameter.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7