CVE-2026-96599: Isotope eCommerce through 2.9.10 Weak Order Identifier Generation
Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer information, and purchased files by supplying a guessed uid parameter.
Affected Software
Event History
Frequently Asked Questions
Who is most exposed to this issue?
Stores using Isotope eCommerce through 2.9.10 that accept guest orders are most exposed. Guest orders do not have ownership verification, so a guessed order identifier can expose their order details.
What does an attacker need to exploit it?
An attacker does not need authentication or user interaction. They need to guess an order identifier and supply it through the uid parameter; exploitation is harder because the attack complexity is rated high.
What information could be disclosed?
Successful access can reveal order details, including billing addresses, customer information, and purchased files.
How can I determine whether my deployment is affected?
Verify whether the site runs Isotope eCommerce version 2.9.10 or earlier and permits guest orders. The affected implementation derives order identifiers using uniqid() rather than a cryptographically secure source.