Brute-force protection bypass via trusted proxy header

IP address spoofing in CleanTalk's Security by CleanTalk 2.120 and earlier allows remote attackers to bypass brute-force login blocking. The login protection accepts the X-Forwarded-For request header as the client address and records the attacker-supplied value without restricting trusted proxies. No authentication or user interaction is required; repeated login attempts can rotate spoofed addresses to evade IP-based request logging and blocking.