LatePoint < 5.6.4 - Agent+ Privilege Escalation to Administrator via order[customer_id] Parameter

Description

The plugin is vulnerable to Privilege Escalation to Administrator due to an Insecure Direct Object Reference (IDOR) in the create_or_update() function of OsOrdersController. An authenticated attacker with Agent-level access can supply an arbitrary order[customer_id] and overwrite any customer's email field — including one linked to a WordPress Administrator account — through the public-scope customer set_data() call. Combined with a missing role verification in OsAuthHelper::authorize_customer(), which logs in the linked WordPress user without checking its role, this makes it possible to elevate privileges to Administrator.