My first thought is that if you have the old password then it was not stored properly in the first place. Need to fix that first.

Second thought is that anything that exposes information about the existing password is an information leak just waiting to be exploited.