CVE-2023-50172: WWBN AVideo recovery notification bypass vulnerability

The vulnerability arises because the userRecoverPass.php script calls setRecoverPass() to generate and save a recovery code (via $user->save()) before validating the captcha. This sequence allows the recovery code to persist in the database regardless of whether the captcha is valid. The Talos report explicitly identifies this flawed logic flow, where the recovery code is created first, making the system vulnerable to silent recovery code generation. The setRecoverPass function is directly responsible for generating the code, and its invocation prior to validation is the root cause.