Subscription through profile page doesn't verify captcha
Subscription in frontusers/profile page has captcha in it, but when savechanges POST request from it is processed, it doesn't verify the captcha.
See frontusers.php#savechanges() method
As the result this savechanges task is vulnerable against malicious use.