Re: Wordpress - Broken Access Control
The is_admin() function is not supposed to tell whether a user is an
administrator or not, it tells whether the user is looking at one of the
administration pages. As such, this function does exactly what it is supposed
to do.
As for the rest, there is no flaw. To view a draft, the user must authenticate
and have the correct capability set. There is no way to view drafts without
being logged in and having that capability set on the user's role level.
This "vulnerability" is non-existent.