CVE-2026-96599

Isotope eCommerce through 2.9.10 derives order identifiers from uniqid instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer...