I have this manually created page:
$user_login = sanitize_text_field( $_GET['user_login'] );
if ( username_exists( $user_login ) || email_exists($user_login) ) { ?>
<!--Everything has been validated, proceed ....-->
<!DOCTYPE HTML>
<html lang="en-US">
<head>
<meta charset="UTF-8">
<title></title>
<script type="text/javascript">
function submit()
{
var f = document.getElementById('lostpasswordform');
f.onclick = function () { };
document.lostpasswordform.submit();
}
</script>
</head>
<body onload="submit()">
<form name="lostpasswordform" id="lostpasswordform" action="<?php echo esc_url( site_url( 'wp-login.php?action=lostpassword', 'login_post' ) ); ?>" method="post">
<input type="hidden" name="user_login" id="user_login" class="input" value="<?php echo ($user_login); ?>" />
<?php do_action('lost_password'); ?>
</form>
</body>
</html>
<?php
echo "SUCCESS";
exit();
} else {
echo "Entered Username or Email was incorrect, please try again!";
}
… everything seems right but it doesn’t work when called from an app, but if I manually visit domain.com/forgot-password?user_login=username it does send the reset pass email fine.
