Here is the steps to reproduce:
- Enable “CAPTCHA (requires extension)” from “Security” → “Advanced” → “User Login Options” → “Password Recovery Page”,
- Enable “CAPTCHA” extension from “Tools” → “Extensions” menu,
- Re-generate ALL the scrip files,
- Go to Password Recovery Page, enter the valid email address, and then enter any string that does not match with the captcha shown,
- Click on “Send” button, system will proceed to next process (this should not be happened),
- In the next page, there are two message displayed; one for the success message and the other is the error message contains “Enter the validation code shown”.
After investigating the case, I found this code in captcha-script.php template file that causes the issue:
$this->Action = “”;
That code above should be like this (in order the CAPTCHA to work properly):
$action = “”;