I believe I have found a small bug pertaining to the CAPTCHA and lostPassword task (index.php?option=com_comprofiler&task=lostPassword). I would expect that whenever a user enters an incorrect CAPTCHA security code, they would recieve some sort of notice that they had entered an invalid security code (similar to that of the account registration process).

However, if the user fails to enter the correct security code, and hits submit, they are redirected back to the lostPassword page without any notification of the error.

I have replicated this problem in a fresh instance of Joomla with the v2.2 and v1.0 CAPTCHA plugin.

Does anyone know how I can hack in the error code?

Thanks in advance!

Environment Details:
Joomla v1.5.9
CB 1.2
CAPTCHA Plugin v2.2