CVE-2026-96599 Details
Description
Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer information, and purchased files by supplying a guessed uid parameter.
A vulnerability exists in Isotope eCommerce versions through 2.9.10, where order identifiers are generated using uniqid() instead of a cryptographically secure method. This flaw allows unauthenticated attackers to guess order identifiers. Additionally, guest orders do not have ownership verification, which enables access to order details such as billing addresses, customer information, and purchased files by supplying a guessed uid parameter.
Users are advised to update to Isotope eCommerce versions after 2.9.10, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 23, 2026CISA-ADP
Assessed Sep 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/isotope/core/issues/2585 | CISA-ADP | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/isotope/core | [email protected] | Vendor |
| https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Model/ProductCollection/Order.php#L612-L618 | [email protected] | Source CodeVendor |
| https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Module/OrderDetails.php#L82-L104 | [email protected] | Source CodeVendor |
| https://github.com/isotope/core/issues/2585 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/isotope-ecommerce-through-2.9.10-weak-order-identifier-generation | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-330 | Use of Insufficiently Random Values | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Isotope eCommerce | <= 2.9.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 23, 2026 | CVE Modified | CISA-ADP |
| Sep 23, 2026 | New CVE Received | [email protected] |