MasterStudy LMS WordPress Plugin – for Online Courses and Education

79 Quality Score

Active Installs

18/30

With 10,000 active installs, MasterStudy sits in the middle of the LMS pack and is far behind category leader Tutor LMS at 100,000 installs.

Update Freshness

25/25

The plugin was updated July 2026 and is tested against WordPress 7.0, indicating active and current maintenance.

User Rating

14/15

A 90 out of 100 rating across 480 reviews signals strong user satisfaction with the core feature set.

Support Health

8/15

With 0 of 2 support threads resolved, the public support presence is thin and may be a concern if you rely on forum-based help.

WP Compatibility

15/15

It supports PHP 7.4 and WordPress 4.6 onward and is tested with the latest WordPress 7.0, giving it a broad compatibility range.

Scores higher than 71% of indexed plugins

About

Learning Management System and eLearning plugin for WordPress. Create easily LMS WordPress website, add and sell Courses, Lessons, Quizzes online.

Active Installs 10k+

Rating ★★★★½ 4.5/5

Last Updated 2026-09-24 4:39am GMT

Requires WordPress 4.6+

Tested Up To 7.0.6

Requires PHP 7.4+

Security History

46 known vulnerabilities, all patched

6 Critical 4 High 36 Medium

Most recent: September 16, 2026

View details ▸

MasterStudy LMS <= 3.7.49 - Authenticated (Instructor+) Insecure Direct Object Reference Medium

September 16, 2026 Patched in ["3.7.50"] CVE-2026-88844

MasterStudy LMS <= 3.7.49 - Authenticated (Instructor+) Insecure Direct Object Reference Medium

September 16, 2026 Patched in ["3.7.50"] CVE-2026-81340

MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Authenticated (Subscriber+) Insecure Direct Object Reference Medium

September 2, 2026 Patched in ["3.7.46"] CVE-2026-81194

MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Unauthenticated Information Exposure Medium

September 2, 2026 Patched in ["3.7.46"] CVE-2026-81199

MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Authenticated (Custom Role+) Insecure Direct Object Reference Medium

September 2, 2026 Patched in ["3.7.46"] CVE-2026-81196

MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Missing Authorization Medium

September 2, 2026 Patched in ["3.7.46"] CVE-2026-81195

MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Authenticated (Custom Role+) Insecure Direct Object Reference Medium

September 2, 2026 Patched in ["3.7.46"] CVE-2026-81198

MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Unauthenticated Unpublished Course Data Exposure Medium

August 31, 2026 Patched in ["3.7.46"] CVE-2026-81197

MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.42 - Authenticated (Custom Role+) Insecure Direct Object Reference Medium

August 29, 2026 Patched in ["3.7.42"] CVE-2026-81200

MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.43 - Unauthenticated Open Redirect High

August 27, 2026 Patched in ["3.7.43"] CVE-2026-81342

MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.40 - Unauthenticated Payment Bypass Medium

August 27, 2026 Patched in ["3.7.40"] CVE-2026-81026

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.42 - Unauthenticated Arbitrary File Deletion Critical

August 24, 2026 Patched in ["3.7.43"] CVE-2026-78284

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.41 - Authenticated (Subscriber+) Privilege Escalation Medium

August 18, 2026 Patched in ["3.7.42"] CVE-2026-68568

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.41 - Missing Authorization Medium

August 18, 2026 Patched in ["3.7.42"] CVE-2026-73404

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.39 - Missing Authorization Medium

July 31, 2026 Patched in ["3.7.40"] CVE-2026-28145

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion Medium

July 28, 2026 Patched in ["3.7.24"] CVE-2026-5060

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting Medium

June 29, 2026 Patched in ["3.7.28"] CVE-2026-57330

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.30 - Missing Authorization Medium

June 26, 2026 Patched in ["3.7.31"] CVE-2026-57640

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.29 - Authenticated (Subscriber+) SQL Injection Medium

May 24, 2026 Patched in ["3.7.30"] CVE-2026-42730

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.25 - Authenticated (Subscriber+) SQL Injection Medium

April 21, 2026 Patched in ["3.7.26"] CVE-2026-40766

MasterStudy LMS <= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters Medium

April 16, 2026 Patched in ["3.7.26"] CVE-2026-4817

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode Medium

February 13, 2026 Patched in ["3.7.12"] CVE-2026-0559

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion Medium

January 5, 2026 Patched in ["3.7.7"] CVE-2025-13766

MasterStudy LMS <= 3.6.27 - Authenticated (Instructor+) SQL Injection Medium

October 23, 2025 Patched in ["3.6.28"] CVE-2025-64366

MasterStudy LMS <= 3.6.20 - Authenticated (Instructor+) Sensitive Information Exposure Medium

October 16, 2025 Patched in ["3.6.21"] CVE-2025-59575

MasterStudy LMS <= 3.6.20 - Authenticated (Subscriber+) Race Condition to Multiple Reviews Medium

September 22, 2025 Patched in ["3.6.21"] CVE-2025-59577

MasterStudy LMS <= 3.6.20 - Missing Authorization Medium

September 22, 2025 Patched in ["3.6.21"] CVE-2025-59576

MasterStudy LMS <= 3.6.15 - Missing Authorization Medium

September 3, 2025 Patched in ["3.6.16"] CVE-2025-54744

MasterStudy LMS <= 3.5.28 - Authenticated (Contributor+) Local File Inclusion High

April 4, 2025 Patched in ["3.5.29"] CVE-2025-32141

MasterStudy LMS <= 3.5.28 - Missing Authorization Medium

April 4, 2025 Patched in ["3.5.29"] CVE-2025-32237

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.23 - Unauthenticated Limited Privilege Escalation to Instructor High

July 1, 2024 Patched in ["3.3.24"] CVE-2024-5973

MasterStudy LMS <= 3.2.12 - Missing Authorization Medium

June 20, 2024 Patched in ["3.2.13"] CVE-2024-37094

MasterStudy LMS <= 3.2.1 - Cross-Site Request Forgery Medium

June 20, 2024 Patched in ["3.2.2"] CVE-2024-37093

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing Authorization Medium

April 29, 2024 Patched in ["3.3.9"] CVE-2024-3942

MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template Critical

April 4, 2024 Patched in ["3.3.4"] CVE-2024-3136

MasterStudy LMS <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action Critical

March 28, 2024 Patched in ["3.3.2"] CVE-2024-2409

MasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modal Critical

March 28, 2024 Patched in ["3.3.1"] CVE-2024-2411

MasterStudy LMS <= 3.2.13 - Missing Authorization to Sensitive Information Exposure in search_posts Medium

March 15, 2024 Patched in ["3.3.0"] CVE-2024-1904

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.10 - Basic Information Exposure via REST route Medium

March 6, 2024 Patched in ["3.2.11"] CVE-2024-2106

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection Critical

February 16, 2024 Patched in ["3.2.6"] CVE-2024-1512

MasterStudy LMS <= 3.0.17 - Privilege Escalation High

August 21, 2023 Patched in ["3.0.18"] CVE-2023-4278

Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get Medium

July 18, 2023 Patched in ["2.8.0"] CVE-2023-33999

MasterStudy LMS <= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

June 15, 2023 Patched in ["3.0.9"] CVE-2023-35090

MasterStudy LMS <= 3.0.8 - Missing Authorization to Course Category Creation Medium

June 15, 2023 Patched in ["3.0.9"] CVE-2023-35093

MasterStudy LMS WordPress Plugin <= 2.9.34 - Missing Authorization via wp_ajax_stm_wpcfto_get_settings Medium

April 3, 2023 Patched in ["2.9.35"]

MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation Critical

February 1, 2022 Patched in ["2.7.6"] CVE-2022-0441

What It Does

MasterStudy LMS is a learning management system for WordPress that lets you build online courses with lessons, quizzes, and student enrollment directly from your dashboard. It includes tools for selling courses, managing instructors, and tracking student progress. The plugin aims to function as an all-in-one eLearning platform without requiring a separate SaaS.

Who It's For

This plugin fits educational businesses, course creators, and training organizations that want to sell and deliver online courses through a self-hosted WordPress site. It is best suited for users who need a full LMS rather than just quizzes or basic content gating. Schools, coaching programs, and membership-based learning sites are typical strong fits.

Who Should Skip It

If you only need a quiz tool or a lightweight course add-on, this plugin is overkill and you would be better served by a focused alternative. Sites looking for a small, lightweight plugin with minimal server load should also skip it, as full LMS plugins tend to consume more resources.

The Bottom Line

MasterStudy LMS delivers a well-rated, actively maintained course platform with a solid 78.91 quality score, but its 10,000 installs and near-empty support threads mean it is not the safest pick for buyers who prioritize community size. It is a strong choice for course sellers who value a modern interface and recent updates, while cautious buyers may prefer Tutor LMS or LearnPress for larger user bases.

Related Plugins

Quiz Maker by AYS 88/100

Pick Quiz Maker if your primary need is flexible quizzes and assessments rather than a full course platform.

Masteriyo LMS 86/100

Choose Masteriyo if you want a comparable full LMS with a similar scope and a slightly higher overall quality score.

Tutor LMS 85/100

Go with Tutor LMS if you want the most popular option in the category with a much larger install base and community.

Interactive Content – H5P 83/100

Pick H5P if you mainly want interactive content types like presentations and videos rather than full course commerce.

LearnPress 82/100

Choose LearnPress if you want an LMS with a longer track record and a large user community to draw on.