CVE-2020-13485: Knock Knock plugin IP Whitelist bypass via an X-Forwarded-For HTTP header

The vulnerability stems from improper IP comparison (CWE-697) where the plugin trusted the X-Forwarded-For header without validation(). The changelog for 1.2.8 explicitly mentions fixing IP fetching to prevent header spoofing, indicating the whitelist check previously relied on untrusted headers. The service class handling access control (KnockKnockService) would contain the IP validation logic, making checkWhitelist the most likely vulnerable function. The high confidence comes from the direct correlation between the vulnerability description, CWE type, and the patch's focus on IP source correction.