Missing rate limit on critical user actions e.g. reset password, change email, disable account.

How it was found

Hi

I found that there are no rate limitations present on actions that require a password inside the account settings. Actions: Paypal email change Account email change Password Change Disable Account (this will not be useful to attacker)

These sensitive actions require additional verification of password so as to protect the user even if the account is left open and is accessed by an attacker. The attacker can try the dictionary attack (or infinite wild guessing) with multiple threads on password on any of these actions without getting rate limited or locked out.