OP just posted that there's a solve. And from a previous update thread apparently their first config was not actually exploitable? So ... seems like it is happening. Maybe not instantly, at least not if the site just remains down for hours because it's functionally DoSed, but it still is apparently exploitable.