The vulnerability in Isotope eCommerce versions up to 2.9.10 allows the generation of order identifiers using the non-cryptographically secure uniqid() function. As guest orders are not protected by ownership checks, an attacker can guess these identifiers through simple enumeration of the uid parameter. Successful guesses grant unauthorized access to a buyer's order details, including the billing address, customer information, and any purchased files. The weakness arises from using an insecure random number generator (CWE-330), which permits predictable identifiers and a straightforward read‑of‑private‑data attack.

The affected platform is Isotope eCommerce's core module. No specific version numbers were listed beyond a maximum of 2.9.10; earlier releases under the isotope-core package are also vulnerable. The vulnerability does not specify operating system reliance and is present purely in the PHP code that handles order creation and detail retrieval.

With a CVSS score of 8.2 the issue is classified as high severity. EPSS information is not provided, and the vulnerability is not part of the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is remote: an unprivileged attacker can issue a standard web request containing a guessed uid value and obtain sensitive order information. Because the identifiers are non‑cryptographically random, an attacker only needs to brute‑force a limited keyspace, making exploitation quite feasible if the system exposes order detail URLs. The absence of authentication checks for guest orders exponentially increases the risk, allowing a wide class of unauthenticated attacks without needing prior knowledge of an account.