What LearnPress does on your site
LearnPress turns WordPress into a learning management system (LMS). It adds content types for courses, lessons, quizzes and questions, a curriculum built from sections you arrange by drag and drop, a profile page for every student (enrolled courses, quiz results, orders) and a checkout flow. Courses can be free or paid, online or in person: in "offline course" mode, the course page shows the location, schedule and start date instead of the curriculum.
The free version already takes payments through PayPal and offline payment, handles PayPal refunds and exports orders to CSV. It ships Gutenberg blocks, Elementor support, a Course Builder that lets instructors create courses without going through the WordPress admin, AI tools (course outlines, quizzes, images) that run on your own OpenAI key, webhooks and an MCP integration. A free backup and migration add-on imports courses from Tutor LMS, LearnDash and MasterStudy LMS.
The developer, ThimPress, makes its money mainly from add-ons and themes. Stripe, selling through WooCommerce, certificates, assignments, the gradebook, content drip, subscriptions and instructor commissions are all paid add-ons, sold one by one or together in the LearnPress Pro Bundle.
Which training projects LearnPress fits
LearnPress is a good pick when you want to start for free and add only the add-ons you actually need:
- Independent trainers and coaches: courses, quizzes, student profiles and PayPal payments are free, enough to sell a first course with no subscription.
- In-person and blended training centers: offline courses show the location, schedule and start date, with online payment.
- Schools and nonprofits with several instructors: instructor sign-up, admin review of courses and a Course Builder outside the admin area.
- Sites moving off another LMS: the free migration tool brings over courses from Tutor LMS, LearnDash and MasterStudy LMS.
It is the wrong choice if you want Stripe, certificates and subscriptions without buying anything: all three are paid add-ons. If your store already runs on WooCommerce, budget for the WooCommerce add-on too, which is also paid. And if you cannot apply updates every week, the pace of security fixes (see below) will be a problem. In that case, compare it with Tutor LMS or LearnDash, a commercial plugin that is not on wordpress.org.
LearnPress strengths and limitations
Strengths
- A real LMS for free. Courses, lessons, quizzes, profiles, orders and PayPal or offline payments with no license.
- In-person courses. Offline mode adapts the course page (location, schedule, start date) without a paid add-on.
- Instructors kept out of the admin. The Course Builder and the instructor redirect limit how much of the dashboard outside accounts can reach.
- Easy migration. The free tool imports courses from Tutor LMS, LearnDash and MasterStudy LMS.
Limitations
- Stripe and certificates cost extra. Stripe, WooCommerce, certificates, assignments and subscriptions each need a premium add-on.
- A heavy vulnerability record. Dozens of flaws were published in 2026 in the Patchstack database, several of them exploitable without an account.
- Near-weekly updates. Most releases in September and October 2026 fix security flaws: a site that falls behind quickly becomes vulnerable.
- Translations lag behind. In translated admin screens, some recent settings (debug mode, MCP, webhooks, AI) still show in English.
The LearnPress settings we recommend
All these settings exist in the current free version, under LearnPress > Settings.
| Setting | Recommended value | Why |
|---|---|---|
| Review courses LearnPress > Settings > Courses | On (default) | Courses created by instructors stay pending review before they go live. |
| Instructor registration LearnPress > Settings > General > Other | Off (default), unless you recruit instructors | When on, the option appears in every registration form on the site. |
| Redirect Instructors to Course Builder Same screen | On if outside instructors have accounts | Instructors who open wp-admin are sent to the Course Builder; administrators are not affected. |
| Publish profile Same screen | Off (default) | When on, every user’s profile page (overview tab) becomes public. |
| Sandbox mode LearnPress > Settings > Payments > PayPal | On for testing, then off | Run a full test purchase in the sandbox before you take real payments. |
| Debug Mode LearnPress > Settings > Advanced | Off in production (default) | This mode is meant for developers; keep it for a staging site. |
| Enable MCP Integration and Enable Webhook LearnPress > Settings > Advanced > MCP and Webhook | Off (default), unless you really use them | Each integration opens access to course data; MCP requires the MCP Adapter plugin and WordPress 6.9 or later. |
| Enable OpenAI LearnPress > Settings > LearnPress AI | Depends on your use | The AI tools send your content to OpenAI with your own secret key, so usage goes on your OpenAI account. |
- In LearnPress > Settings > General, check that the courses, profile and checkout pages are assigned.
- Place a test order in the PayPal sandbox, then turn sandbox mode off and confirm it is really off.
- Log in with a test instructor account: it should land on the Course Builder, and its courses should stay pending review.
- In Plugins, turn on auto-updates for LearnPress and its add-ons, or schedule an update every week.
LearnPress security: serious flaws and fixes to follow closely
LearnPress exposes a lot of data (courses, orders, quiz results) through its REST API and AJAX requests, and several serious flaws have come through there. The most notable:
- CVE-2024-8522 and CVE-2024-8529, fixed in 4.2.7.1: two unauthenticated SQL injections through course REST API routes, both rated 10 out of 10 (CVSS).
- CVE-2023-6567, fixed in 4.2.5.8: unauthenticated SQL injection through the
order_byparameter (CVSS 9.8). - CVE-2023-6634, fixed in 4.2.5.8: a visitor without an account could call public PHP functions, with a risk of code execution (CVSS 8.1).
- In 2026: the Patchstack database lists, among others, unauthenticated leaks of order data, quiz answers and user information, and an unauthenticated PHP object injection affecting versions up to 4.4.10.
The useful habit is simple: always run the latest version, ideally with auto-updates (see our guide to automatic plugin updates), and get notified of new flaws with plugin vulnerability alerts. WP Masquerade Pro hides the /wp-content/plugins/learnpress/ folder in file URLs and the LearnPress script IDs, which makes the plugin harder to spot for bots that target these flaws, without replacing updates; the lp-* CSS classes and the lpData JavaScript variable remain visible.
What WP Masquerade hides for LearnPress
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to LearnPress: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
Still visible
- JavaScript variables
lpData, lpSettingCourses - CSS classes
learn-press-*, lp-*
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
LearnPress FAQ
Is LearnPress really free?
The core plugin is free and is enough to create courses and quizzes and sell them through PayPal or offline payment. Stripe, WooCommerce, certificates, assignments or subscriptions require paid add-ons.
How much does the LearnPress Pro Bundle cost?
The official page lists $299 (crossed out from $710) for one site, with 12 months of updates and support; each extra year costs $209.30. After that, the add-ons keep working, but without new versions or support.
Can I switch from Tutor LMS or LearnDash to LearnPress?
Yes: the free LearnPress Backup & Migration Tool add-on imports courses from Tutor LMS, LearnDash and MasterStudy LMS. Test the migration on a copy of the site before you switch.
Are the LearnPress AI tools included?
They are part of the free version but off by default: you turn on the option and enter your own OpenAI secret key in LearnPress > Settings > LearnPress AI. API calls are therefore billed to your OpenAI account.