What Tutor LMS does on your site
Tutor LMS turns WordPress into an online learning platform. It adds content types for courses, lessons and quizzes, a visual course builder, and a Tutor LMS admin menu with courses, students, quiz attempts, Q&A and instructors. Every student and instructor also gets a front-end dashboard on the site (courses, progress, results).
The free version already covers the basics: unlimited courses, lessons and quizzes, self-hosted, YouTube and Vimeo video, multiple instructors per site, notes and discussions, a Kids mode, light or dark mode, basic certificates and basic reports. It can also sell courses with no other plugin: orders, coupons and taxes run through the native eCommerce, with PayPal or manual payment. WooCommerce remains an option as the sales engine.
The developer, Themeum, sells Tutor LMS Pro, a separate plugin that unlocks every add-on: content bank, assignments, content drip, prerequisites, course bundles, subscriptions and memberships, Stripe and the other gateways, the certificate builder, live classes on Zoom, Google Meet or Jitsi, and AI Studio, which generates outlines, lessons and quizzes using your own OpenAI API key.
Which sites Tutor LMS is a good fit for
Tutor LMS fits when training is the core of the site and you want to run everything inside WordPress:
- Independent trainers and coaches: the free version is enough to publish courses, run quizzes and sell courses one by one.
- Schools, training centers and nonprofits: role-based dashboards, multiple instructors and progress tracking come at no cost.
- Course marketplaces: with Pro, instructors sell their own courses and you split revenue through commissions.
- Sites leaving another LMS: a free migration tool imports courses, sales and students from LearnDash, LearnPress and LifterLMS.
It is not the right choice if all you want is to lock pages behind a paid membership: a membership plugin such as MemberPress is more direct. It is also a poor bet if nobody can apply updates every week, given the pace of security fixes (see below).
Tutor LMS strengths and limitations
Strengths
- A generous free version. Unlimited courses, quizzes, students and instructors, plus dashboards and basic certificates, without paying.
- Built-in selling. Orders, coupons and taxes are handled by Tutor LMS itself, with no need to install WooCommerce.
- A polished learner experience. App-like layout on mobile, Kids mode, dark mode, notes and a Q&A area shared across courses.
- Pro without à la carte add-ons. Every plan includes all Pro add-ons and themes, and a lifetime license is available.
Limitations
- Many vulnerabilities in 2026. A large share of the fixes released in 2026 address flaws that a plain student account, or even no account, can exploit.
- Limited free payments. Without Pro, the native eCommerce only accepts PayPal and manual payment; Stripe, Mollie or Razorpay are paid.
- Advanced teaching tools are Pro-only. Assignments, content drip, prerequisites, advanced quiz types and subscriptions require the license.
- AI costs twice. AI Studio requires Pro plus an OpenAI API key, billed separately by OpenAI.
The settings we recommend for Tutor LMS
These settings exist in the free version, under Tutor LMS > Settings. They limit what instructors and students can do without your approval.
| Setting | Recommended value | Why |
|---|---|---|
| Allow Instructors to Publish Courses Tutor LMS > Settings > General > Instructor | Off (default) | A course created by an instructor waits for your review before it goes live. |
| Become an Instructor Button Same section | Off (default), unless you run an open marketplace | This button on the student dashboard invites people to apply for an instructor account; several vulnerabilities required exactly that role. |
| Allow Instructors to Trash Courses Same section | Off on a site with several instructors | On by default; a stolen instructor account can no longer make courses disappear. |
| Publish Course Review on Admin’s Approval Tutor LMS > Settings > Course | On | Reviews go through moderation, which keeps out spam and abusive reviews. |
| Enable Lesson Comment Tutor LMS > Settings > Course > Lesson | Off (default), unless you really need it | One more field to moderate; the Q&A area already covers discussions. |
| Select eCommerce Engine Tutor LMS > Settings > Monetization > Options | Disable Monetization (default) as long as you sell nothing | Coupons, orders and payment status have been hit by several vulnerabilities: no reason to turn that code on without sales. |
| Erase upon uninstallation Tutor LMS > Settings > Advanced > Options | Off (default) | When on, deleting the plugin wipes all its data, including courses and student progress. |
- Turn on automatic updates for Tutor LMS under Plugins.
- Create a test student account, enroll it in a free course and take a quiz: this checks enrollment, progress and grading.
- Tutor LMS uses its own login form by default (the “Enable Tutor LMS Login” setting, Advanced > Options): check that your login attempt limits or two-factor authentication also apply to it.
- Review the list under Tutor LMS > Instructors regularly: every instructor account should belong to someone who still teaches on the site.
Tutor LMS security: many flaws, often with little or no privilege
The Patchstack database lists several dozen fixed vulnerabilities in Tutor LMS, a large share of them published in 2026. The point that matters for your decision: on a learning site, any visitor can create a student account, and many of these flaws need nothing more than that level of access, or none at all. The most notable:
- CVE-2024-10400, versions up to 2.7.6: unauthenticated SQL injection through the
rating_filterparameter, which allowed data to be extracted from the database (CVSS 7.5). - CVE-2025-13673, versions up to 3.9.6: unauthenticated SQL injection through the coupon code (
coupon_code), partially mitigated in 3.9.4 and then in 3.9.6 (CVSS 7.5). - CVE-2026-16759, versions up to 4.0.5: limited code execution without an account, through the course filter’s
tutor_course_filter_ajaxAJAX action (CVSS 6.5). - CVE-2026-78175, versions up to 4.0.7: PHP object injection leading to code execution, with a plain subscriber account, through the handler that saves the earnings withdrawal account (CVSS 8.8).
Version 4.2.0 again fixed unauthorized REST API access (course content, quiz answers, user details). The useful move is to apply updates right away, ideally automatically (see our guide to automatic plugin updates), and to hand out the instructor role sparingly (see WordPress roles and capabilities). WP Masquerade Pro removes the Tutor LMS generator tag, the plugin folder addresses and its script IDs from your pages, which makes it harder for bots targeting these flaws to spot it; the tutor-* CSS classes and the _tutorobject JavaScript object stay visible, and nothing replaces updating.
What WP Masquerade hides for Tutor LMS
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to Tutor LMS: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- generator tag
- folder name
- tag IDs
Still visible
- JavaScript variables
_tutorobject - CSS classes
tutor-*
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
Frequently asked questions about Tutor LMS
Is the free version of Tutor LMS enough to sell courses?
Yes for selling individual courses: the native eCommerce handles orders, coupons and taxes with PayPal or manual payment. Stripe and the other gateways, subscriptions, course bundles and guest checkout require Tutor LMS Pro.
How much does Tutor LMS Pro cost?
The official page lists $199 per year for one site, $399 for ten sites and $799 for unlimited sites, excluding taxes. Lifetime licenses cost $499, $999 and $1,999 (one, ten or 50 sites), with a 30-day money-back guarantee.
Can you switch from LearnDash or LearnPress to Tutor LMS?
Yes. Themeum publishes a free migration plugin that moves courses, sales and students over from LearnDash, LearnPress and LifterLMS.