{ "title": "LearnPress", "seo_title": "LearnPress: review, recommended settings and limits", "h1": "LearnPress", "description": "LearnPress free or Pro Bundle: strengths, limitations, pricing, recommended settings and patched vulnerabilities, to decide and set up your LMS.", "lead": "LearnPress, the free LMS plugin from ThimPress, lets you create and sell online or in-person courses in WordPress. Our take on what the free version covers, the paid add-ons, the settings to check and the vulnerabilities that call for steady updates.", "language": "en", "locale": "en-US", "type": "plugin-sheet", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/learnpress/", "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/learnpress/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/learnpress/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/learnpress/index.json", "published": "2026-11-04T08:00:00+00:00", "modified": "2026-11-05T21:13:53+00:00", "site": { "name": "WP Masquerade", "url": "https://www.wp-masquerade.com/" }, "translations": [ { "language": "en", "hreflang": "en-US", "title": "LearnPress", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/learnpress/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/learnpress/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/learnpress/index.json" }, { "language": "fr", "hreflang": "fr-FR", "title": "LearnPress", "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/learnpress/", "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/learnpress/index.md", "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/learnpress/index.json" }, { "language": "es", "hreflang": "es-ES", "title": "LearnPress", "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/learnpress/", "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/learnpress/index.md", "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/learnpress/index.json" }, { "language": "de", "hreflang": "de-DE", "title": "LearnPress", "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/learnpress/", "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/learnpress/index.md", "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/learnpress/index.json" }, { "language": "it", "hreflang": "it-IT", "title": "LearnPress", "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/learnpress/", "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/learnpress/index.md", "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/learnpress/index.json" }, { "language": "pt", "hreflang": "pt-BR", "title": "LearnPress", "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/learnpress/", "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/learnpress/index.md", "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/learnpress/index.json" }, { "language": "nl", "hreflang": "nl-NL", "title": "LearnPress", "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/learnpress/", "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/learnpress/index.md", "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/learnpress/index.json" } ], "headings": [ { "level": 1, "text": "LearnPress" }, { "level": 2, "text": "What LearnPress does on your site" }, { "level": 2, "text": "Which training projects LearnPress fits" }, { "level": 2, "text": "LearnPress strengths and limitations" }, { "level": 3, "text": "Strengths" }, { "level": 3, "text": "Limitations" }, { "level": 2, "text": "The LearnPress settings we recommend" }, { "level": 2, "text": "LearnPress security: serious flaws and fixes to follow closely" }, { "level": 2, "text": "LearnPress FAQ", "id": "faq" } ], "body": "## The essentials\n\n- Best for trainers and training centers that want to sell courses without paying for a license upfront.\n- Main caveat: frequent flaws, several without an account, so updates have to be applied steadily.\n- Free; the Pro Bundle costs $299 for one site and adds Stripe, certificates, assignments and subscriptions.\n\n## What LearnPress does on your site\n\nLearnPress turns WordPress into a learning management system (LMS). It adds content types for courses, lessons, quizzes and questions, a curriculum built from sections you arrange by drag and drop, a profile page for every student (enrolled courses, quiz results, orders) and a checkout flow. Courses can be free or paid, online or in person: in \"offline course\" mode, the course page shows the location, schedule and start date instead of the curriculum.\n\nThe free version already takes payments through PayPal and offline payment, handles PayPal refunds and exports orders to CSV. It ships Gutenberg blocks, Elementor support, a Course Builder that lets instructors create courses without going through the WordPress admin, AI tools (course outlines, quizzes, images) that run on your own OpenAI key, webhooks and an MCP integration. A free backup and migration add-on imports courses from Tutor LMS, LearnDash and MasterStudy LMS.\n\nThe developer, ThimPress, makes its money mainly from add-ons and themes. Stripe, selling through WooCommerce, certificates, assignments, the gradebook, content drip, subscriptions and instructor commissions are all paid add-ons, sold one by one or together in the LearnPress Pro Bundle.\n\n![Diagram: LearnPress works on visitors and bots, wordpress, external services. Public traces: folder name (hidden with Pro); tag IDs (hidden with Pro); JavaScript variables (still visible); CSS classes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/learnpress/diagram-en.svg?v=57081dd7)\n\n## Which training projects LearnPress fits\n\nLearnPress is a good pick when you want to start for free and add only the add-ons you actually need:\n\n- **Independent trainers and coaches**: courses, quizzes, student profiles and PayPal payments are free, enough to sell a first course with no subscription.\n- **In-person and blended training centers**: offline courses show the location, schedule and start date, with online payment.\n- **Schools and nonprofits with several instructors**: instructor sign-up, admin review of courses and a Course Builder outside the admin area.\n- **Sites moving off another LMS**: the free migration tool brings over courses from Tutor LMS, LearnDash and MasterStudy LMS.\n\nIt is the wrong choice if you want Stripe, certificates and subscriptions without buying anything: all three are paid add-ons. If your store already runs on [WooCommerce](https://www.wp-masquerade.com/features/camouflaged-plugins/woocommerce/), budget for the WooCommerce add-on too, which is also paid. And if you cannot apply updates every week, the pace of security fixes (see below) will be a problem. In that case, compare it with [Tutor LMS](https://www.wp-masquerade.com/features/camouflaged-plugins/tutor-lms/) or [LearnDash](https://www.wp-masquerade.com/features/camouflaged-plugins/learndash/), a commercial plugin that is not on wordpress.org.\n\n## LearnPress strengths and limitations\n\n### Strengths\n\n- **A real LMS for free.** Courses, lessons, quizzes, profiles, orders and PayPal or offline payments with no license.\n- **In-person courses.** Offline mode adapts the course page (location, schedule, start date) without a paid add-on.\n- **Instructors kept out of the admin.** The Course Builder and the instructor redirect limit how much of the dashboard outside accounts can reach.\n- **Easy migration.** The free tool imports courses from Tutor LMS, LearnDash and MasterStudy LMS.\n\n### Limitations\n\n- **Stripe and certificates cost extra.** Stripe, WooCommerce, certificates, assignments and subscriptions each need a premium add-on.\n- **A heavy vulnerability record.** Dozens of flaws were published in 2026 in the Patchstack database, several of them exploitable without an account.\n- **Near-weekly updates.** Most releases in September and October 2026 fix security flaws: a site that falls behind quickly becomes vulnerable.\n- **Translations lag behind.** In translated admin screens, some recent settings (debug mode, MCP, webhooks, AI) still show in English.\n\n## The LearnPress settings we recommend\n\nAll these settings exist in the current free version, under LearnPress > Settings.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Review courses** LearnPress > Settings > Courses | On (default) | Courses created by instructors stay pending review before they go live. |\n| **Instructor registration** LearnPress > Settings > General > Other | Off (default), unless you recruit instructors | When on, the option appears in every registration form on the site. |\n| **Redirect Instructors to Course Builder** Same screen | On if outside instructors have accounts | Instructors who open wp-admin are sent to the Course Builder; administrators are not affected. |\n| **Publish profile** Same screen | Off (default) | When on, every user’s profile page (overview tab) becomes public. |\n| **Sandbox mode** LearnPress > Settings > Payments > PayPal | On for testing, then off | Run a full test purchase in the sandbox before you take real payments. |\n| **Debug Mode** LearnPress > Settings > Advanced | Off in production (default) | This mode is meant for developers; keep it for a staging site. |\n| **Enable MCP Integration** and **Enable Webhook** LearnPress > Settings > Advanced > MCP and Webhook | Off (default), unless you really use them | Each integration opens access to course data; MCP requires the MCP Adapter plugin and WordPress 6.9 or later. |\n| **Enable OpenAI** LearnPress > Settings > LearnPress AI | Depends on your use | The AI tools send your content to OpenAI with your own secret key, so usage goes on your OpenAI account. |\n\n- In LearnPress > Settings > General, check that the courses, profile and checkout pages are assigned.\n- Place a test order in the PayPal sandbox, then turn sandbox mode off and confirm it is really off.\n- Log in with a test instructor account: it should land on the Course Builder, and its courses should stay pending review.\n- In Plugins, turn on auto-updates for LearnPress and its add-ons, or schedule an update every week.\n\n## LearnPress security: serious flaws and fixes to follow closely\n\nLearnPress exposes a lot of data (courses, orders, quiz results) through its REST API and AJAX requests, and several serious flaws have come through there. The most notable:\n\n- **CVE-2024-8522 and CVE-2024-8529, fixed in 4.2.7.1**: two unauthenticated [SQL injections](https://www.wp-masquerade.com/glossary/sql-injection/) through course REST API routes, both rated 10 out of 10 (CVSS).\n- **CVE-2023-6567, fixed in 4.2.5.8**: unauthenticated SQL injection through the `order_by` parameter (CVSS 9.8).\n- **CVE-2023-6634, fixed in 4.2.5.8**: a visitor without an account could call public PHP functions, with a risk of code execution (CVSS 8.1).\n- **In 2026**: the Patchstack database lists, among others, unauthenticated leaks of order data, quiz answers and user information, and an unauthenticated PHP object injection affecting versions up to 4.4.10.\n\nThe useful habit is simple: always run the latest version, ideally with auto-updates (see our guide to automatic plugin updates), and get notified of new flaws with [plugin vulnerability alerts](https://www.wp-masquerade.com/features/vulnerable-plugin-alerts/). WP Masquerade Pro hides the `/wp-content/plugins/learnpress/` folder in file URLs and the LearnPress script IDs, which makes the plugin harder to spot for bots that target these flaws, without replacing updates; the `lp-*` CSS classes and the `lpData` JavaScript variable remain visible.\n\n## LearnPress FAQ\n\n**Is LearnPress really free?**\n\nThe core plugin is free and is enough to create courses and quizzes and sell them through PayPal or offline payment. Stripe, WooCommerce, certificates, assignments or subscriptions require paid add-ons.\n\n**How much does the LearnPress Pro Bundle cost?**\n\nThe official page lists $299 (crossed out from $710) for one site, with 12 months of updates and support; each extra year costs $209.30. After that, the add-ons keep working, but without new versions or support.\n\n**Can I switch from Tutor LMS or LearnDash to LearnPress?**\n\nYes: the free LearnPress Backup & Migration Tool add-on imports courses from Tutor LMS, LearnDash and MasterStudy LMS. Test the migration on a copy of the site before you switch.\n\n**Are the LearnPress AI tools included?**\n\nThey are part of the free version but off by default: you turn on the option and enter your own OpenAI secret key in LearnPress > Settings > LearnPress AI. API calls are therefore billed to your OpenAI account.\n\n## Key facts\n\n- Category: Membership and courses\n- Vendor: ThimPress\n- Price: Free; LearnPress Pro Bundle listed at $299 for one site, with 12 months of updates and support\n- Active installations (wordpress.org): 70 000+\n- Version: 4.4.13\n- Official page: https://wordpress.org/plugins/learnpress/\n\n## What WP Masquerade hides\n\n- Handled by WP Masquerade Pro only\n- With Pro: folder name, tag IDs\n- Still visible: JavaScript variables, CSS classes", "catalog": "learnpress", "essentials": [ "Best for trainers and training centers that want to sell courses without paying for a license upfront.", "Main caveat: frequent flaws, several without an account, so updates have to be applied steadily.", "Free; the Pro Bundle costs $299 for one site and adds Stripe, certificates, assignments and subscriptions." ], "format": "application/json" }