Tutor LMS – eLearning and online course solution

89 Quality Score

Active Installs

23/30

With 100,000 active installs it has real market penetration, though it trails LearnPress and LearnDash in scale within the LMS niche.

Update Freshness

25/25

A release date of July 2026 against WordPress 7.0.1 signals very recent, proactive updates from the development team.

User Rating

13/15

An 88 out of 100 across 582 reviewers indicates broadly satisfied users with only mild criticism dragging the average down.

Support Health

14/15

Only 27 support threads with a 63 percent resolution rate suggests a smaller public support footprint, and unresolved tickets are a yellow flag.

WP Compatibility

15/15

Full marks for compatibility thanks to up-to-date WordPress 7.0.1 testing and a reasonable PHP 7.4 floor that covers most modern hosts.

Scores higher than 99% of indexed plugins

About

A complete WordPress LMS plugin to create any eLearning website easily.

Active Installs 100k+

Rating ★★★★ 4.4/5

Last Updated 2026-09-17 11:29am GMT

Requires WordPress 5.3+

Tested Up To 7.1.1

Requires PHP 7.4+

Security History

91 known vulnerabilities, all patched

3 Critical 18 High 69 Medium 1 Low

Most recent: September 21, 2026

View details ▸

Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter Medium

September 21, 2026 Patched in ["4.0.8"] CVE-2026-18439

Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters Medium

September 18, 2026 Patched in ["4.0.9"] CVE-2026-89081

Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter Medium

September 18, 2026 Patched in ["4.0.9"] CVE-2026-88944

Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter Medium

September 18, 2026 Patched in ["4.0.9"] CVE-2026-89333

Tutor LMS 2.7.1 - 4.0.7 - REST API Authentication Confusion Medium

September 14, 2026 Patched in ["4.0.8"] CVE-2026-85569

Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) Information Exposure Medium

September 14, 2026 Patched in ["4.0.8"] CVE-2026-85572

Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution High

September 11, 2026 Patched in ["4.0.8"] CVE-2026-78175

Tutor LMS – eLearning and online course solution < 4.0.6 - Authenticated (Custom Role+) Arbitrary File Read Medium

August 28, 2026 Patched in ["4.0.6"] CVE-2026-19093

Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters Medium

August 27, 2026 Patched in ["4.0.6"] CVE-2026-16759

Tutor LMS <= 4.0.5 - Unauthenticated Arbitrary Zero-Argument Function Invocation Critical

August 26, 2026 Patched in ["4.0.6"] CVE-2026-19092

Tutor LMS – eLearning and online course solution < 4.0.6 - Unauthenticated SQL Injection High

August 24, 2026 Patched in ["4.0.6"] CVE-2026-19094

Tutor LMS <= 4.0.5 - Authenticated (Instructor+) Insecure Direct Object Reference Medium

August 20, 2026 Patched in ["4.0.6"] CVE-2026-14187

Tutor LMS – eLearning and online course solution < 4.0.0 - Missing Authorization Medium

July 30, 2026 Patched in ["4.0.0"] CVE-2026-14310

Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter Medium

July 27, 2026 Patched in ["4.0.2"] CVE-2026-15444

Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array Medium

July 15, 2026 Patched in ["4.0.1"] CVE-2026-15022

Tutor LMS – eLearning and online course solution <= 3.9.13 - Unauthenticated Insecure Direct Object Reference Medium

July 6, 2026 Patched in ["3.9.14"] CVE-2026-57694

Tutor LMS <= 3.9.13 - Authenticated (Subscriber+) Information Exposure Medium

July 2, 2026 Patched in ["3.9.14"] CVE-2026-14306

Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title Medium

June 30, 2026 Patched in ["3.9.14"] CVE-2026-13443

Tutor LMS <= 3.9.12 - Authenticated (Subscriber+) Information Disclosure Medium

June 22, 2026 Patched in ["3.9.13"] CVE-2026-12275

Tutor LMS <= 3.9.12 - Missing Authorization to Authenticated (Subscriber+) Comment Creation Medium

June 22, 2026 Patched in ["3.9.13"] CVE-2026-12273

Tutor LMS <= 3.9.12 - Authenticated (Subscriber+) Insecure Direct Object Reference to Quiz Attemp Modification Medium

June 22, 2026 Patched in ["3.9.13"] CVE-2026-12271

Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter Medium

June 17, 2026 Patched in ["3.9.12"] CVE-2026-10736

Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter Medium

May 12, 2026 Patched in ["3.9.10"] CVE-2026-6965

Tutor LMS – eLearning and online course solution <= 3.9.7 - Missing Authorization Medium

April 20, 2026 Patched in ["3.9.8"] CVE-2026-40743

Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter Medium

April 16, 2026 Patched in ["3.9.9"] CVE-2026-6080

Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order Medium

April 16, 2026 Patched in ["3.9.9"] CVE-2026-5502

Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification Medium

April 10, 2026 Patched in ["3.9.8"] CVE-2026-3371

Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment Medium

April 10, 2026 Patched in ["3.9.8"] CVE-2026-3358

Tutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter High

April 9, 2026 Patched in ["3.9.8"] CVE-2026-3360

Tutor LMS – eLearning and online course solution <= 3.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference Medium

March 16, 2026 Patched in ["3.9.5"] CVE-2025-32223

Tutor LMS <= 3.9.7 - Missing Authorization Medium

March 15, 2026 Patched in ["3.9.8"] CVE-2026-40740

Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code High

February 27, 2026 Patched in ["3.9.7"] CVE-2025-13673

Tutor LMS – eLearning and online course solution <= 3.9.5 - Missing Authorization Medium

February 25, 2026 Patched in ["3.9.6"] CVE-2026-23799

Tutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action Medium

February 2, 2026 Patched in ["3.9.6"] CVE-2026-1371

Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion High

February 2, 2026 Patched in ["3.9.6"] CVE-2026-1375

Tutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion Medium

January 20, 2026 Patched in ["3.9.5"] CVE-2026-0548

Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification Medium

January 8, 2026 Patched in ["3.9.4"] CVE-2025-13628

Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion Medium

January 8, 2026 Patched in ["3.9.4"] CVE-2025-13935

Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass Medium

January 8, 2026 Patched in ["3.9.4"] CVE-2025-13934

Tutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details Medium

January 7, 2026 Patched in ["3.9.4"] CVE-2025-13679

Tutor LMS <= 3.9.4 - Authenticated (Instructor+) Insecure Direct Object Reference Medium

January 2, 2026 Patched in ["3.9.5"] CVE-2025-47555

Tutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information Exposure Medium

October 24, 2025 Patched in ["3.9.0"] CVE-2025-6680

Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update Medium

October 24, 2025 Patched in ["3.9.0"] CVE-2025-11564

Tutor LMS <= 3.7.4 - Authenticated (Administrator+) SQL Injection Medium

September 9, 2025 Patched in ["3.8.0"] CVE-2025-58993

Tutor LMS <= 3.4.0 - Authenticated (Subscriber+) HTML Injection Medium

April 7, 2025 Patched in ["3.4.1"] CVE-2025-32230

Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter High

November 20, 2024 Patched in ["2.7.7"] CVE-2024-10400

Tutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registration Medium

November 20, 2024 Patched in ["2.7.7"] CVE-2024-10393

Tutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable' Medium

September 9, 2024 Patched in ["2.7.5"] CVE-2023-2919

Tutor LMS <= 2.7.2 - Authenticated (Administrator+) SQL Injection High

August 16, 2024 Patched in ["2.7.3"] CVE-2024-43282

Tutor LMS <= 2.7.3 - Authenticated (Instructor+) Stored Cross-Site Scripting Medium

August 9, 2024 Patched in ["2.7.4"] CVE-2024-43231

Tutor LMS <= 2.7.3 - Missing Authorization Medium

August 7, 2024 Patched in ["2.7.4"] CVE-2024-43142

Tutor LMS <= 2.7.2 - Cross-Site Request Forgery Medium

August 1, 2024 Patched in ["2.7.3"] CVE-2024-39645

Tutor LMS <= 2.7.2 - Authenticated (Tutor Instructor+) Stored Cross-Site Scripting Medium

July 10, 2024 Patched in ["2.7.3"] CVE-2024-37947

Tutor LMS <= 2.7.1 - Authenticated (Admin+) Path Traversal Low

June 27, 2024 Patched in ["2.7.2"] CVE-2024-37266

Tutor LMS – eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL Injection High

June 6, 2024 Patched in ["2.7.2"] CVE-2024-4902

Tutor LMS – eLearning and online course solution <= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion Medium

June 6, 2024 Patched in ["2.7.2"] CVE-2024-5438

Tutor LMS – eLearning and online course solution <= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion Medium

May 15, 2024 Patched in ["2.7.1"] CVE-2024-4279

Tutor LMS <= 2.7.0 - Authenticated (Instructor+) SQL Injection High

May 15, 2024 Patched in ["2.7.1"] CVE-2024-4318

Tutor LMS <= 2.7.0 - Missing Authorization Critical

May 15, 2024 Patched in ["2.7.1"] CVE-2024-4223

Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update Medium

April 26, 2024 Patched in ["2.7.0"] CVE-2024-3553

Tutor LMS – eLearning and online course solution <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcode Medium

April 24, 2024 Patched in ["2.7.0"] CVE-2024-3994

Tutor LMS – eLearning and online course solution <= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data Erase Medium

March 12, 2024 Patched in ["2.6.2"] CVE-2024-1503

Tutor LMS – eLearning and online course solution <= 2.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion Medium

March 12, 2024 Patched in ["2.6.2"] CVE-2024-1502

Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection High

March 11, 2024 Patched in ["2.6.2"] CVE-2024-1751

Tutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&A Medium

February 20, 2024 Patched in ["2.6.1"] CVE-2024-1128

Tutor LMS <= 2.6.0 - Missing Authorization Medium

February 20, 2024 Patched in ["2.6.1"] CVE-2024-1133

Tutor LMS <= 2.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

December 5, 2023 Patched in ["2.3.0"] CVE-2023-49829

Tutor LMS <= 2.2.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting Medium

September 25, 2023 Patched in ["2.3.0"] CVE-2023-4805

Tutor LMS <= 2.2.0 - Missing Authorization via REST API High

June 12, 2023 Patched in ["2.2.1"] CVE-2023-3133

Tutor LMS <= 2.2.0 - Authenticated (Student+) SQL Injection High

May 30, 2023 Patched in ["2.2.1"] CVE-2023-25800

Tutor LMS <= 2.1.10 - Authenticated (Tutor Instructor+) SQL Injection High

May 30, 2023 Patched in ["2.2.0"] CVE-2023-25990

Tutor LMS <= 2.1.10 - Unauthenticated SQL Injection Critical

May 30, 2023 Patched in ["2.2.0"] CVE-2023-25700

Tutor LMS <= 2.1.8 - Missing Authorization via multiple AJAX actions Medium

May 24, 2023 Patched in ["2.1.9"] CVE-2023-25799

Tutor LMS <= 2.0.9 - Reflected Cross-Site Scripting Medium

January 12, 2023 Patched in ["2.0.10"] CVE-2023-0236

Tutor LMS <= 2.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

September 26, 2022 Patched in ["2.0.10"] CVE-2022-2563

Tutor LMS – eLearning and online course solution 2.0.0-2.0.8 - Reflected Cross-Site Scripting Medium

August 22, 2022 Patched in ["2.0.9"]

Tutor LMS <= 1.9.11 - Stored Cross-Site Scripting High

December 27, 2021 Patched in ["1.9.12"]

Tutor LMS <= 1.9.11 - Reflected Cross-Site Scripting Medium

December 27, 2021 Patched in ["1.9.12"] CVE-2021-25017

Tutor LMS <= 1.9.10 - Reflected Cross-Site Scripting Medium

October 19, 2021 Patched in ["1.9.11"] CVE-2021-24873

Tutor LMS <= 1.9.8 - Admin+ Stored Cross-Site Scripting Medium

September 20, 2021 Patched in ["1.9.9"] CVE-2021-24740

Tutor LMS <= 1.9.5 - Cross-Site Scripting Medium

August 9, 2021 Patched in ["1.9.6"]

Tutor LMS <= 1.9.1 - Authenticated Stored Cross-Site Scripting Medium

June 28, 2021 Patched in ["1.9.2"] CVE-2021-24455

Tutor LMS <= 1.8.7 - Authenticated Local File Inclusion Medium

April 5, 2021 Patched in ["1.8.8"] CVE-2021-24242

Tutor LMS – eLearning and online course solution <= 1.7.6 - Unprotected AJAX including Privilege Escalation High

March 15, 2021 Patched in ["1.7.7"] CVE-2021-24184

Tutor LMS <= 1.8.2 - SQL Injection via tutor_quiz_builder_get_question_form Medium

March 15, 2021 Patched in ["1.8.3"] CVE-2021-24183

Tutor LMS – eLearning and online course solution <=1.7.6 - SQL Injection Medium

March 15, 2021 Patched in ["1.7.7"] CVE-2021-24185

Tutor LMS – eLearning and online course solution <= 1.7.6 - SQL Injection Medium

March 15, 2021 Patched in ["1.7.7"] CVE-2021-24181

Tutor LMS <=1.8.2 - SQL Injection via tutor_quiz_builder_get_answers_by_question High

March 15, 2021 Patched in ["1.8.3"] CVE-2021-24182

Tutor LMS <=1.8.2 - SQL Injection via tutor_answering_quiz_question/get_answer_by_id High

March 15, 2021 Patched in ["1.8.3"] CVE-2021-24186

Tutor LMS <= 1.9.12 - Reflected Cross-Site Scripting Medium

January 10, 2021 Patched in ["1.9.13"]

Tutor LMS < 1.5.3 - Cross-Site Request Forgery High

February 4, 2020 Patched in ["1.5.3"] CVE-2020-8615

What It Does

Tutor LMS is a full-featured WordPress learning management system that lets site owners build, sell, and run online courses without writing code. It handles course builders, quizzes, certificates, assignments, multimedia lessons, and student progress tracking. Add-ons extend functionality into monetization, multi-instructor setups, and Zoom integration.

Who It's For

This plugin fits education entrepreneurs, training departments, and small universities who want an out-of-the-box LMS with room to grow into paid courses, memberships, or cohort-based programs. It is best suited to those who want a polished front-end experience plus an ecosystem of premium add-ons rather than a bare-bones free LMS. Non-technical instructors who need a guided setup wizard will get the most value.

Who Should Skip It

If you only need a simple quiz or survey tool, Quiz Maker is lighter and purpose-built. Site owners on legacy PHP or older WordPress versions under 5.3 cannot run this plugin.

The Bottom Line

Tutor LMS earns an overall 85.04 out of 100 and is one of the strongest general-purpose LMS plugins available, especially for sellers who plan to grow into paid courses. The unresolved support threads and required PHP 7.4 are minor concerns, but the consistent update cadence and high user ratings make it a safe bet.

Related Plugins

Quiz Maker by AYS 88/100

Choose this if you only need quizzes and surveys rather than a full course platform.

Masteriyo LMS 86/100

Pick Masteriyo if you want a faster, more modern interface and are willing to trade Tutor's larger add-on catalogue.

Interactive Content – H5P 83/100

Reach for H5P when interactive content like video quizzes and branching scenarios matters more than a complete course engine.

LearnPress 82/100

Consider LearnPress for a more established open-source community and comparable install base.

Uncanny Toolkit for LearnDash 81/100

Pick this only if you already run LearnDash and want to extend it, not as a standalone LMS.