Isotope eCommerce EUVD-2026-85340

Requires that the target Isotope eCommerce installation (through 2.9.10) accepts guest orders, since the flaw is the combination of order identifiers generated from uniqid() (Order.php) and the absence of ownership verification on the guest order-details module (OrderDetails.php). Exploitation is remote and unauthenticated with no user interaction, but is limited by the need to guess valid uid values - uniqid() is time-seeded and enumerable rather than instantly known, which is why CVSS assigns AC:H. Shops that do not expose guest orders, or that have upgraded past 2.9.10, are not exposed.

This is a genuine but bounded confidentiality risk. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H) supports remote, unauthenticated access with no user interaction, which raises priority, but AC:H correctly reflects that exploitation depends on defeating uniqid()-based identifiers, which are time-seeded and enumerable but not instantly known - an attacker must guess/brute-force valid uid values. Impact is strictly confidentiality (VI:N/VA:N): disclosure of order details, billing addresses, customer PII, and purchased downloadable files, with no integrity or availability effect. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation; the 8.2 score is driven by the sensitive-data exposure and network reach rather than by demonstrated ease of attack. Net: a real data-exposure issue worth patching, but the AC:H brute-force requirement and niche product footprint make it a moderate priority rather than an emergency, absent any exploitation signal.

An unauthenticated attacker who knows or guesses the pattern of a target shop's order identifiers enumerates likely uid values (since they derive from time-based uniqid() rather than a CSPRNG) and requests the guest order-details page for each. Because guest orders perform no ownership verification, a matching uid returns another customer's billing address, personal information, and purchased files. No public exploit code was identified at time of analysis, and the AC:H rating reflects that valid identifiers must be guessed rather than directly known.