v.1.2.20 Protection Bypass due to IP Spoofing vulnerability

The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it’s block feature by spoofing the headers.

See

So 1.2.20 is no longer vulnerable as it now defaults to an override to REMOTE_ADDR. Anyone can choose to override it to another setting depending on if they use caching or not.