LatePoint < 5.2.8 - Agent+ Privilege Escalation

Description

The plugin is vulnerable to privilege escalation via password reset due to the plugin allowing users with a LatePoint Agent role, who are creating new customers to set the 'wordpress_user_id' field. This makes it possible for authenticated attackers, with Agent-level access and above, to gain elevated privileges by linking a customer to the arbitrary user ID, including administrators, and then resetting the password.