Bug with HUGE security risk

Hi team,
I found a bug that is very problematic in terms of security and confidentiality.
Basically, I discovered that a simple vendor can see all posts, no matter what his permissions are at the role level.
I discovered that a seller with no administrator rights can see the content of all posts, even those in draft, even those in the trash, even those private, EVEN those protected by a password!!!

To do so, the admin creates a notice.
Then, the seller will be able to see the notice by clicking on a link which will look like this:
mydomain.com/admin/wcfm-notice-view/1002
The “1002” refers to a post id. If the seller changes this number to any other number, he will see the title and content of the post having this id.
For example, admin changed the first post ever that was initially like “welcome to wordpress” and added sensitive data to other site administrators and add the password-protected post option.
The seller, if he go to mydomain.com/admin/wcfm-notice-view/1 will see the title and the content, without even having to add a password.

Please look into it.

Im here to help and test anything else if you need to 🙂

-Lewis, WCFM lover