Agent-to-Administrator escalation via customer identity overwrite

Privilege escalation in LatePoint 5.6.3 and earlier allows remote authenticated users with Agent access to obtain Administrator privileges. OsOrdersController::create_or_update accepts an arbitrary order[customer_id] and uses public-scope set_data to replace the selected customer's email; OsAuthHelper::authorize_customer then logs in the linked WordPress user without verifying its role. Agent-level access is sufficient to target a customer linked to an Administrator account, bind that identity to an attacker-controlled email address, and take over the Administrator session.