What LearnDash LMS does on your site
LearnDash LMS turns WordPress into a learning platform. A drag-and-drop course builder organizes courses, lessons, topics and quizzes, and quizzes support eight question types (multiple choice, essay, sorting, fill-in-the-blank and more). The plugin also handles assignment uploads, certificates, a Focus Mode that shows lessons without the theme’s distractions, and an AI assistant that drafts a course outline from a short description.
Every course has an access mode: open, free, buy now, recurring or closed. Sales run through Stripe Connect, PayPal Checkout or Razorpay, all built in, with coupons on top, and MemberDash, also built in, adds membership plans. Since version 5.2.0 (September 2026), the WooCommerce integration and notifications are part of the LearnDash core. Groups let you sell seats to an organization: a Group Leader enrolls their team and exports progress and quiz results as CSV.
LearnDash is owned by Liquid Web (part of the StellarWP family of brands). It is a commercial plugin, not listed on wordpress.org, and it installs in the sfwd-lms folder. The official documentation asks for PHP 7.4 or later, MySQL 5.6 or MariaDB 10.1 at minimum, HTTPS and 128 MB of PHP memory. LearnDash supports the current WordPress version plus the two before it, and it does not support multisite.
Which sites LearnDash LMS is a good fit for
LearnDash suits training projects that have a business model and room for an annual license:
- Course creators and training providers: graded quizzes, assignments, certificates and progress reports cover a full learning path with no extra plugin.
- Corporate training and B2B sales: group seats and the Group Leader role let the client manage their own learners.
- Membership sites: MemberDash sells tiered subscriptions without a third-party membership plugin.
- Organizers who mix courses and events: every plan includes The Events Calendar, handy for live sessions or blended learning.
It is not the right pick for testing an idea on a zero budget: Tutor LMS and LearnPress both have a free version. Skip it on a multisite network as well.
LearnDash LMS strengths and limitations
Strengths
- A complete teaching toolkit. Eight question types, graded assignments, certificates and Focus Mode come with the purchase.
- Selling without a third-party plugin. Stripe Connect, PayPal Checkout, Razorpay, coupons and MemberDash memberships are built in.
- Groups built for B2B sales. Seats sold in bulk, a self-managing Group Leader and CSV exports of progress.
- A public changelog. Security fixes ship in dedicated releases, labeled as such in the official changelog.
Limitations
- No free version. The pricing page only offers bundled plans, starting at $350 per year for one site.
- Updates tied to the license. Without an active license you lose automatic updates, official add-ons and support.
- No multisite. The official documentation rules out multisite installs.
- Vulnerabilities a learner can exploit. In 2026, assignment uploads and the REST API let a subscriber, or even a visitor with no account, get around access checks.
- Uneven translations. On the official translation platform, French, German and Italian are nearly complete, while Spanish, Dutch and Brazilian Portuguese remain very partial.
The LearnDash LMS settings we recommend
Labels match the LearnDash 5.2 interface. Assignment settings are set lesson by lesson, in the Settings tab of the lesson editor.
| Setting | Recommended value | Why |
|---|---|---|
| Active Template LearnDash LMS > Settings > General | LearnDash 3.0 | The Legacy template has been unsupported since June 15, 2025, and both Focus Mode and the built-in login and registration require LearnDash 3.0. |
| Assignment Uploads LearnDash LMS > Lessons > your lesson > Settings | On only for lessons that need an assignment | Every lesson that accepts assignments lets enrolled learners upload files to your server. |
| File Extensions Same screen | A short list, for example pdf, docx | Left blank, the field accepts every file type WordPress allows. |
| File Size Limit Same screen | For example 5M | Your host also sets a cap, and the lower limit wins. |
| Grading Type Same screen | Manually grade if an instructor reviews assignments | By default an assignment is auto-approved with full points; with manual grading, the lesson stays incomplete until the assignment is approved. |
| License Visibility LearnDash LMS > Settings > Advanced | Add a second trusted administrator | Otherwise only the administrator who installed LearnDash can see the license and receive updates. |
| Data Sharing LearnDash LMS > Settings > Advanced | Per your privacy policy | Sharing usage statistics with StellarWP is optional, and LearnDash works fine without it. |
| Logs LearnDash LMS > Settings > Advanced | Off (default), on only while troubleshooting | They record imports, exports and PayPal, Stripe Connect and Razorpay transactions, so there is no reason to keep them running. |
| Include in Reports LearnDash LMS > Settings > General > Admin User Settings | Off | Your own tests no longer skew the statistics. |
- In Plugins, confirm LearnDash LMS is at version 5.1.6.1 or later, which fixes both June 2026 vulnerabilities.
- If registration is open (Settings > General > "Anyone can register"), keep Subscriber as the default role for new accounts.
- On a lesson with an assignment, try uploading a file type that is not allowed: it should be rejected.
- Run a full purchase in Stripe Connect Test Mode before switching to Live Mode.
LearnDash security: vulnerabilities within a learner’s reach
A course platform hands out accounts to strangers, and the notable LearnDash vulnerabilities often need nothing more than a learner account, or no account at all:
- CVE-2026-12483, fixed in 5.1.5.1: a subscriber enrolled in a course that accepts assignments could upload disallowed files, PHP included, because only the first file of the upload was checked (CVSS 7.5).
- CVE-2026-12843, versions 4.25.0 to 5.1.6, fixed in 5.1.6.1: with no account, an attacker could enroll any user in a paid course through the REST API without payment (CVSS 5.4).
- CVE-2026-3079, fixed in 5.0.3.1: blind SQL injection with a contributor account, through a reporting AJAX action (CVSS 6.5).
- CVE-2023-3105, fixed in 4.6.0.1: any account could change another user’s password, administrators included (CVSS 8.8).
- CVE-2020-6009, fixed in 3.1.6: SQL injection exploitable with no account.
Keep the license active and apply every security release as soon as it ships, ideally automatically (see our guide to automatic plugin updates). Also limit elevated roles such as contributor or Group Leader to the people who need them (see WordPress roles and capabilities). WP Masquerade Pro replaces the sfwd-lms folder addresses and the LearnDash script handles, which makes the plugin harder for bots hunting these flaws to spot; the ld-* CSS classes, the ldVars JavaScript object and the /wp-json/ldlms/v2/ REST route stay visible, and nothing replaces updating.
What WP Masquerade hides for LearnDash LMS
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to LearnDash LMS: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
Still visible
- JavaScript variables
ldVars - CSS classes
learndash-wrapper, ld-* - REST routes
/wp-json/ldlms/v2/
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
LearnDash LMS FAQ
Is there a free version of LearnDash?
No. LearnDash is paid only; the vendor offers an online demo so you can try it before buying.
How much does LearnDash cost, and can you buy it on its own?
The official pricing page only lists bundled plans, which also include The Events Calendar, Give and Kadence: $350 per year for one site, $599 for 10 sites, $799 for 25, $899 for 50 and $999 for 100.
What happens if the license is not renewed?
The plugin stays installed, but the documentation states that an active license is required to receive automatic updates, official add-ons and support, which means security fixes too.
Do you need WooCommerce to sell courses with LearnDash?
No. Stripe Connect, PayPal Checkout and Razorpay are built in. If you already sell with WooCommerce, the integration has been part of the LearnDash core since version 5.2.0.
Does LearnDash work on a multisite network?
No, the official documentation states that multisite configurations are not supported.