[gvx]

That is correct.

The client sends the encrypted (via HTTPS) but not hashed password to the server, both for changing your password and checking your password. So the server receives the password in plaintext but shouldn't store it.

Whatever the client sends to the server, an attacker can send too.