Input validation vulnerability in User Access Manager 2.2.16

The User Access Manager plugin for WordPress is vulnerable to a type of security attack called IP Address Spoofing in versions up to, and including, 2.2.16. This is because the plugin doesn’t have enough restrictions, and it gets the IP Address information from the wrong place. Attackers can use a header called “X-Forwarded-For” with a different IP Address than their own, and the wrong IP Address will be logged. This can be used to get around settings that prevent someone from accessing certain areas.