No. The original submission described the vulnerability as requiring an authenticated user, but it was later discovered (recently) that it works unauthenticated

No. The original submission described the vulnerability as requiring an authenticated user, but it was later discovered (recently) that it works unauthenticated too, and that's what kicked off this mass exploitation. No user account is required.