Login No Captcha reCAPTCHA < 1.7 - IP Check Bypass

Proof of Concept

Set HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR or any other header in LoginNoCaptcha::get_ip_address() which is then checked against the whitelist and Google reCaptcha.
The only caveat on this PoC is that attacker must know the list of IP addresses added to the allow list. This can be done by luring administrators to fake pages, but increases the complexity of the attack.