Input validation vulnerability in WP-PostRatings 1.91

The WP-PostRatings plugin for WordPress is not secure in versions up to and including 1.91. Attackers can use a method called IP Address Spoofing to bypass security settings. This is because the plugin doesn’t put enough restrictions on where it gets the IP Address information from for logging requests and user logins. Attackers can provide a false IP Address in the X-Forwarded-For header, which will then be logged instead of the real one.