diff --git a/src/Forms/ConfirmedPasswordField.php b/src/Forms/ConfirmedPasswordField.php
index e4b3840ec..dd022be49 100644
--- a/src/Forms/ConfirmedPasswordField.php
+++ b/src/Forms/ConfirmedPasswordField.php
@@ -573,7 +573,7 @@ class ConfirmedPasswordField extends FormField
     public function performReadonlyTransformation()
     {
         /** @var ReadonlyField $field */
-        $field = $this->castedCopy('SilverStripe\\Forms\\ReadonlyField')
+        $field = $this->castedCopy(ReadonlyField::class)
             ->setTitle($this->title ? $this->title : _t('SilverStripe\\Security\\Member.PASSWORD', 'Password'))
             ->setValue('*****');
 
diff --git a/tests/php/Forms/ConfirmedPasswordFieldTest.php b/tests/php/Forms/ConfirmedPasswordFieldTest.php
index f4fd8b253..d5b7218d5 100644
--- a/tests/php/Forms/ConfirmedPasswordFieldTest.php
+++ b/tests/php/Forms/ConfirmedPasswordFieldTest.php
@@ -7,12 +7,12 @@ use SilverStripe\Dev\SapphireTest;
 use SilverStripe\Forms\ConfirmedPasswordField;
 use SilverStripe\Forms\FieldList;
 use SilverStripe\Forms\Form;
+use SilverStripe\Forms\ReadonlyField;
 use SilverStripe\Forms\RequiredFields;
 use SilverStripe\Security\Member;
 
 class ConfirmedPasswordFieldTest extends SapphireTest
 {
-
     public function testSetValue()
     {
         $field = new ConfirmedPasswordField('Test', 'Testing', 'valueA');
@@ -25,6 +25,9 @@ class ConfirmedPasswordFieldTest extends SapphireTest
         $this->assertEquals('valueB', $field->children->fieldByName($field->getName() . '[_ConfirmPassword]')->Value());
     }
 
+    /**
+     * @useDatabase true
+     */
     public function testHashHidden()
     {
         $field = new ConfirmedPasswordField('Password', 'Password', 'valueA');
@@ -202,6 +205,73 @@ class ConfirmedPasswordFieldTest extends SapphireTest
         );
     }
 
+    public function testCurrentPasswordValidation()
+    {
+        $field = new ConfirmedPasswordField('Test', 'Testing', [
+            '_Password' => 'abc',
+            '_ConfirmPassword' => 'abc',
+        ]);
+        $field->setRequireExistingPassword(true);
+
+        $validator = new RequiredFields();
+        $result = $field->validate($validator);
+
+        $this->assertFalse($result, 'Validate method should return its result');
+        $this->assertFalse($validator->getResult()->isValid());
+        $this->assertContains(
+            'You must enter your current password',
+            $validator->getResult()->serialize()
+        );
+    }
+
+    public function testMustBeLoggedInToChangePassword()
+    {
+        $field = new ConfirmedPasswordField('Test', 'Testing');
+        $field->setRequireExistingPassword(true);
+        $field->setValue([
+            '_CurrentPassword' => 'foo',
+            '_Password' => 'abc',
+            '_ConfirmPassword' => 'abc',
+        ]);
+
+        $validator = new RequiredFields();
+        $this->logOut();
+        $result = $field->validate($validator);
+
+        $this->assertFalse($result, 'Validate method should return its result');
+        $this->assertFalse($validator->getResult()->isValid());
+        $this->assertContains(
+            'You must be logged in to change your password',
+            $validator->getResult()->serialize()
+        );
+    }
+
+    /**
+     * @useDatabase true
+     */
+    public function testValidateCorrectPassword()
+    {
+        $this->logInWithPermission('ADMIN');
+
+        $field = new ConfirmedPasswordField('Test', 'Testing');
+        $field->setRequireExistingPassword(true);
+        $field->setValue([
+            '_CurrentPassword' => 'foo-not-going-to-be-the-correct-password',
+            '_Password' => 'abc',
+            '_ConfirmPassword' => 'abc',
+        ]);
+
+        $validator = new RequiredFields();
+        $result = $field->validate($validator);
+
+        $this->assertFalse($result, 'Validate method should return its result');
+        $this->assertFalse($validator->getResult()->isValid());
+        $this->assertContains(
+            'The current password you have entered is not correct',
+            $validator->getResult()->serialize()
+        );
+    }
+
     public function testTitle()
     {
         $this->assertNull(ConfirmedPasswordField::create('Test')->Title(), 'Should not have it\'s own title');
@@ -218,8 +288,7 @@ class ConfirmedPasswordFieldTest extends SapphireTest
 
     public function testSetRightTitlePropagatesToChildren()
     {
-        /** @var ConfirmedPasswordField $field */
-        $field = ConfirmedPasswordField::create('Test');
+        $field = new ConfirmedPasswordField('Test');
 
         $this->assertCount(2, $field->getChildren());
         foreach ($field->getChildren() as $child) {
@@ -234,8 +303,7 @@ class ConfirmedPasswordFieldTest extends SapphireTest
 
     public function testSetChildrenTitles()
     {
-        /** @var ConfirmedPasswordField $field */
-        $field = ConfirmedPasswordField::create('Test');
+        $field = new ConfirmedPasswordField('Test');
         $field->setRequireExistingPassword(true);
         $field->setChildrenTitles([
             'Current Password',
@@ -247,4 +315,38 @@ class ConfirmedPasswordFieldTest extends SapphireTest
         $this->assertSame('Password', $field->getChildren()->shift()->Title());
         $this->assertSame('Confirm Password', $field->getChildren()->shift()->Title());
     }
+
+    public function testPerformReadonlyTransformation()
+    {
+        $field = new ConfirmedPasswordField('Test', 'Change it');
+        $result = $field->performReadonlyTransformation();
+
+        $this->assertInstanceOf(ReadonlyField::class, $result);
+        $this->assertSame('Change it', $result->Title());
+        $this->assertContains('***', $result->Value());
+    }
+
+    public function testPerformDisabledTransformation()
+    {
+        $field = new ConfirmedPasswordField('Test', 'Change it');
+        $result = $field->performDisabledTransformation();
+
+        $this->assertInstanceOf(ReadonlyField::class, $result);
+    }
+
+    public function testSetRequireExistingPasswordOnlyRunsOnce()
+    {
+        $field = new ConfirmedPasswordField('Test', 'Change it');
+
+        $this->assertCount(2, $field->getChildren());
+
+        $field->setRequireExistingPassword(true);
+        $this->assertCount(3, $field->getChildren(), 'Current password field was not pushed');
+
+        $field->setRequireExistingPassword(true);
+        $this->assertCount(3, $field->getChildren(), 'Current password field should not be pushed again');
+
+        $field->setRequireExistingPassword(false);
+        $this->assertCount(2, $field->getChildren(), 'Current password field should not be removed');
+    }
 }