This issue has reproduced in 1.1.0rc2.

In verify.php 31L

replace

if( OFF == config_get( 'lost_password_feature' ) ||
    OFF == config_get( 'send_reset_password' ) ||
    OFF == config_get( 'enable_email_notification' ) ) {

with

if( <b>(</b> OFF == config_get( 'lost_password_feature' ) <b>&&</b>
    OFF == config_get( 'send_reset_password' ) <b>)</b> ||
    OFF == config_get( 'enable_email_notification' ) ) {
    trigger_error( ERROR_LOST_PASSWORD_NOT_ENABLED, ERROR );
}

This will fix 0008520

I don't think I agree with the change. I am thinking of dropping this if statement completely. If a user is using verify.php then he/she already received the email, hence, not much use of checking email settings. We can't also check for lost password setting since verify is also used during signup.

Now that I stop to think about it, you are right.
It is better to drop it.

As far as I can see no change regarding this issue has been made in verify.php shipped with 1.2.0a1.
Are there any plans when to fix this security related issue?

Fixed in both trunk and 1.1.X branch (will show in 1.1.2 and 1.2.0a2)