CVE-2026-96599: Isotope Isotope-Core

Medium severity, CVSS 5.9. EPSS: 0.4% chance of exploitation in the next 30 days.

Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer information, and purchased files by supplying a guessed uid parameter.

Affected products

• Isotope Isotope-Core: up to and including 2.9.10

Published 2026-09-23. Last modified 2026-09-24.