Joomla Stack Exchange is a question and answer site for Joomla! administrators, users, developers and designers. It only takes a minute to sign up.
Sign up to join this community
Multiple users are reporting their 'forgot password' / password reset function is being triggered, and that they're receiving emails with the verification code etc, even though they didn't request a password reset.
The forgot password / password reset form requires an email address input so I can't imagine how spam bots would be able to submit that form (without knowing users email address). So I am baffled.
How to prevent this from happening?
You can prevent this attack by implementing some low-grade authentication before firing the reset script.
You might use a recaptcha or automated math question, to stop automated (bot) attacks.
To more strenuously confront both bot and human attacks in a personalized fashion, have your users verify their account by answering a "secret question" (which was part of the registration process) before triggering the reset process.
Here's some additional reading:
