CVE-2026-96599

Name of the Vulnerable Software and Affected Versions Isotope eCommerce versions prior to 2.9.11

Description The software generates order identifiers using the uniqid() function rather than a cryptographically secure source, which allows unauthenticated attackers to predict these identifiers. Because guest orders do not undergo ownership verification, an attacker can access sensitive order details—including billing addresses, customer information, and purchased files—by providing a guessed value to the uid parameter.

Recommendations Update Isotope eCommerce to version 2.9.11 or later.