---
title: "LearnDash LMS"
description: "LearnDash LMS: who it is worth the license for, plan pricing, recommended assignment and license settings, and the vulnerabilities fixed in 2026."
language: "en"
locale: "en-US"
type: "plugin-sheet"
canonical: "https://www.wp-masquerade.com/features/camouflaged-plugins/learndash/"
published: "2026-11-04T08:00:00+00:00"
modified: "2026-11-05T21:13:46+00:00"
translations:
  en-US: "https://www.wp-masquerade.com/features/camouflaged-plugins/learndash/index.md"
  fr-FR: "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/learndash/index.md"
  es-ES: "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/learndash/index.md"
  de-DE: "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/learndash/index.md"
  it-IT: "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/learndash/index.md"
  pt-BR: "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/learndash/index.md"
  nl-NL: "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/learndash/index.md"
---

# LearnDash LMS

LearnDash LMS, the online learning plugin from Liquid Web, builds and sells courses with quizzes, assignments, certificates and groups. Our take on whether its license is worth it with no free version, the assignment and license settings to check, and the recent vulnerabilities to patch.

## The essentials

- Best for training providers selling courses, quizzes and certificates, including group seats.
- Main caveat: no free version, and updates stop if the annual license lapses.
- Paid: $350 per year for one site, bundled with The Events Calendar, Give and Kadence.

## What LearnDash LMS does on your site

LearnDash LMS turns WordPress into a learning platform. A drag-and-drop course builder organizes courses, lessons, topics and quizzes, and quizzes support eight question types (multiple choice, essay, sorting, fill-in-the-blank and more). The plugin also handles assignment uploads, certificates, a Focus Mode that shows lessons without the theme’s distractions, and an AI assistant that drafts a course outline from a short description.

Every course has an access mode: open, free, buy now, recurring or closed. Sales run through Stripe Connect, PayPal Checkout or Razorpay, all built in, with coupons on top, and MemberDash, also built in, adds membership plans. Since version 5.2.0 (September 2026), the WooCommerce integration and notifications are part of the LearnDash core. Groups let you sell seats to an organization: a Group Leader enrolls their team and exports progress and quiz results as CSV.

LearnDash is owned by Liquid Web (part of the StellarWP family of brands). It is a commercial plugin, not listed on wordpress.org, and it installs in the `sfwd-lms` folder. The official documentation asks for PHP 7.4 or later, MySQL 5.6 or MariaDB 10.1 at minimum, HTTPS and 128 MB of PHP memory. LearnDash supports the current WordPress version plus the two before it, and it does not support multisite.

![Diagram: LearnDash LMS works on visitors and bots, wordpress, external services. Public traces: folder name (hidden with Pro); tag IDs (hidden with Pro); JavaScript variables (still visible); CSS classes (still visible); REST routes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/learndash/diagram-en.svg?v=e4bfb51e)

## Which sites LearnDash LMS is a good fit for

LearnDash suits training projects that have a business model and room for an annual license:

- **Course creators and training providers**: graded quizzes, assignments, certificates and progress reports cover a full learning path with no extra plugin.
- **Corporate training and B2B sales**: group seats and the Group Leader role let the client manage their own learners.
- **Membership sites**: MemberDash sells tiered subscriptions without a third-party membership plugin.
- **Organizers who mix courses and events**: every plan includes [The Events Calendar](https://www.wp-masquerade.com/features/camouflaged-plugins/the-events-calendar/), handy for live sessions or blended learning.

It is not the right pick for testing an idea on a zero budget: [Tutor LMS](https://www.wp-masquerade.com/features/camouflaged-plugins/tutor-lms/) and [LearnPress](https://www.wp-masquerade.com/features/camouflaged-plugins/learnpress/) both have a free version. Skip it on a multisite network as well.

## LearnDash LMS strengths and limitations

### Strengths

- **A complete teaching toolkit.** Eight question types, graded assignments, certificates and Focus Mode come with the purchase.
- **Selling without a third-party plugin.** Stripe Connect, PayPal Checkout, Razorpay, coupons and MemberDash memberships are built in.
- **Groups built for B2B sales.** Seats sold in bulk, a self-managing Group Leader and CSV exports of progress.
- **A public changelog.** Security fixes ship in dedicated releases, labeled as such in the official changelog.

### Limitations

- **No free version.** The pricing page only offers bundled plans, starting at $350 per year for one site.
- **Updates tied to the license.** Without an active license you lose automatic updates, official add-ons and support.
- **No multisite.** The official documentation rules out multisite installs.
- **Vulnerabilities a learner can exploit.** In 2026, assignment uploads and the REST API let a subscriber, or even a visitor with no account, get around access checks.
- **Uneven translations.** On the official translation platform, French, German and Italian are nearly complete, while Spanish, Dutch and Brazilian Portuguese remain very partial.

## The LearnDash LMS settings we recommend

Labels match the LearnDash 5.2 interface. Assignment settings are set lesson by lesson, in the Settings tab of the lesson editor.

| Setting | Recommended value | Why |
| --- | --- | --- |
| **Active Template**  LearnDash LMS > Settings > General | LearnDash 3.0 | The Legacy template has been unsupported since June 15, 2025, and both Focus Mode and the built-in login and registration require LearnDash 3.0. |
| **Assignment Uploads**  LearnDash LMS > Lessons > your lesson > Settings | On only for lessons that need an assignment | Every lesson that accepts assignments lets enrolled learners upload files to your server. |
| **File Extensions**  Same screen | A short list, for example `pdf, docx` | Left blank, the field accepts every file type WordPress allows. |
| **File Size Limit**  Same screen | For example `5M` | Your host also sets a cap, and the lower limit wins. |
| **Grading Type**  Same screen | Manually grade if an instructor reviews assignments | By default an assignment is auto-approved with full points; with manual grading, the lesson stays incomplete until the assignment is approved. |
| **License Visibility**  LearnDash LMS > Settings > Advanced | Add a second trusted administrator | Otherwise only the administrator who installed LearnDash can see the license and receive updates. |
| **Data Sharing**  LearnDash LMS > Settings > Advanced | Per your privacy policy | Sharing usage statistics with StellarWP is optional, and LearnDash works fine without it. |
| **Logs**  LearnDash LMS > Settings > Advanced | Off (default), on only while troubleshooting | They record imports, exports and PayPal, Stripe Connect and Razorpay transactions, so there is no reason to keep them running. |
| **Include in Reports**  LearnDash LMS > Settings > General > Admin User Settings | Off | Your own tests no longer skew the statistics. |

- In Plugins, confirm LearnDash LMS is at version 5.1.6.1 or later, which fixes both June 2026 vulnerabilities.
- If registration is open (Settings > General > "Anyone can register"), keep Subscriber as the default role for new accounts.
- On a lesson with an assignment, try uploading a file type that is not allowed: it should be rejected.
- Run a full purchase in Stripe Connect Test Mode before switching to Live Mode.

## LearnDash security: vulnerabilities within a learner’s reach

A course platform hands out accounts to strangers, and the notable LearnDash vulnerabilities often need nothing more than a learner account, or no account at all:

- **CVE-2026-12483, fixed in 5.1.5.1**: a subscriber enrolled in a course that accepts assignments could upload disallowed files, PHP included, because only the first file of the upload was checked (CVSS 7.5).
- **CVE-2026-12843, versions 4.25.0 to 5.1.6, fixed in 5.1.6.1**: with no account, an attacker could enroll any user in a paid course through the REST API without payment (CVSS 5.4).
- **CVE-2026-3079, fixed in 5.0.3.1**: blind [SQL injection](https://www.wp-masquerade.com/glossary/sql-injection/) with a contributor account, through a reporting AJAX action (CVSS 6.5).
- **CVE-2023-3105, fixed in 4.6.0.1**: any account could change another user’s password, administrators included (CVSS 8.8).
- **CVE-2020-6009, fixed in 3.1.6**: SQL injection exploitable with no account.

Keep the license active and apply every security release as soon as it ships, ideally automatically (see our guide to automatic plugin updates). Also limit elevated roles such as contributor or Group Leader to the people who need them (see WordPress roles and capabilities). WP Masquerade Pro replaces the `sfwd-lms` folder addresses and the LearnDash script handles, which makes the plugin harder for bots hunting these flaws to spot; the `ld-*` CSS classes, the `ldVars` JavaScript object and the `/wp-json/ldlms/v2/` REST route stay visible, and nothing replaces updating.

## LearnDash LMS FAQ

**Is there a free version of LearnDash?**

No. LearnDash is paid only; the vendor offers an online demo so you can try it before buying.

**How much does LearnDash cost, and can you buy it on its own?**

The official pricing page only lists bundled plans, which also include The Events Calendar, Give and Kadence: $350 per year for one site, $599 for 10 sites, $799 for 25, $899 for 50 and $999 for 100.

**What happens if the license is not renewed?**

The plugin stays installed, but the documentation states that an active license is required to receive automatic updates, official add-ons and support, which means security fixes too.

**Do you need WooCommerce to sell courses with LearnDash?**

No. Stripe Connect, PayPal Checkout and Razorpay are built in. If you already sell with WooCommerce, the integration has been part of the LearnDash core since version 5.2.0.

**Does LearnDash work on a multisite network?**

No, the official documentation states that multisite configurations are not supported.

## Key facts

- Category: Membership and courses
- Vendor: Liquid Web (StellarWP)
- Price: Paid: $350 per year for one site, bundled with The Events Calendar, Give and Kadence
- Official page: https://www.liquidweb.com/software/learndash/

## What WP Masquerade hides

- Handled by WP Masquerade Pro only
- With Pro: folder name, tag IDs
- Still visible: JavaScript variables, CSS classes, REST routes