This part is too vague:

According to Zerial, in order to exploit the vulnerability, an administrator or user with sufficient permissions must have an active session.

What does that mean, exactly? The exploit can only work on targeting logged-in admin? The exploit can only work to target other users if there is an admin who has logged in?