shouldiuse.io

Report

Should I Use Tutor LMS | Most Powerful WordPress LMS Plugin?

tutorlms.com·Analyzed 7 hours ago··Based on 11 sources

Planning to launch an eLearning site? FREE download Tutor LMS, the most powerful WordPress LMS plugin to kickstart your online classroom. Learning management system for all!

Depends

Depends

Buy if you run WordPress, can commit to fast plugin patching, and want a free-to-start course platform.

Powerful free WordPress LMS, but a messy 2026 security record means you must patch fast or pick a hosted option.

Confidence: Medium

Yes

Free version

Core plugin on WordPress.org

$99/site

Pro add-ons price

Third-party 2022 listing, unverified

5+

2026 CVEs

Auth bypass, SQLi, IDOR disclosed

100,000+

Sites exposed

By one PHP object injection flaw

Value for money4

Free core; pro add-ons roughly $99/site

Ease of use4

Lessons, quizzes, progress flow in one space

Feature depth4

Quizzes, live sessions, multi-instructor marketplace tools

Support quality4

User reports bugs fixed quickly by support

Security posture1

Repeated 2026 CVEs including auth bypass and SQLi

Pros

  • Free core plugin with full course toolkit²
  • Lessons, quizzes, notes, live sessions in one continuous space¹
  • Multi-instructor marketplace with publish approval controls³
  • Course videos restricted to enrolled students only³
  • Users report support fixes bugs quickly²

Cons

  • Five-plus 2026 CVEs including auth bypass and SQL injection⁵
  • One flaw exposed 100,000+ sites to code execution⁴
  • Pro version separately flagged for broken access control⁸
  • No dedicated security page on official site
  • Older version had CSRF flaw letting attackers add users10

Gotchas

  • highVersions before 4.0.6 have known unauthenticated SQL injection and ownership-check gaps. Patch immediately.⁶
  • mediumOfficial pricing is buried; third-party data cites $99/site and may be stale. Confirm before buying.11
  • mediumMarketplace features and advanced content security are premium-only, not in the free core.³
  • lowReviewers report hitting bugs, though support resolved them.²

Best for

  • Solo tutors selling courses on WordPress
  • Course marketplaces with multiple instructors
  • Budget creators wanting a free core
  • Teams comfortable managing plugin updates

Not for

  • Anyone storing sensitive learner or payment data — the security record is rough
  • Non-WordPress sites
  • Buyers wanting hands-off hosted LMS with vendor-managed security
  • Enterprises needing SLAs and security compliance guarantees

Pricing

Free

$0

  • Core LMS plugin on WordPress.org
  • Create and sell basic courses

Pro add-ons

$99/site (2022 third-party listing)

  • Marketplace and advanced quiz features
  • Verify current pricing — listing may be stale

Security

Poor track record: at least five 2026 CVEs including authentication bypass and unauthenticated SQL injection.

  • PHP Object Injection (2026)Affected more than 100,000 WordPress sites per Wordfence Argus.⁴
  • CVE-2026-0548Authentication bypass vulnerability in the plugin.⁵
  • CVE-2026-19094Unauthenticated SQL injection in versions before 4.0.6.⁶
  • CVE-2026-14187 / CVE-2026-12274Missing per-object ownership checks and IDOR letting instructors overwrite posts; fixed in 4.0.6 / 3.9.13.⁹
  • CVE-2020-8615CSRF in v1.5.3 allowed attackers to add users.10

What users say

WordPress.org reviewers praise the feature set and responsive support while acknowledging occasional bugs.

“After hours and hours of research and trying several LMS platforms, I have decided to purchase Tutor LMS. I've run into some bugs, but they were quickly solved by their customer support team.”
— WordPress.org plugin reviews, nowhereman78

Alternatives

Compare Tutor LMS | Most Powerful WordPress LMS Plugin with each alternative.

LearnDash

Veteran WordPress LMS with a large ecosystem

Teachable

Hosted option: no plugin updates or security patching

Full analysis

Based on 14 public sources; security coverage is deep, pricing data is thin and dated.

Sources

  1. Tutor LMS official sitetutorlms.com
    official
  2. Tutor LMS on WordPress.orgwordpress.org
    review
  3. Tutor LMS feature reviewfahimm.com
    review
  4. Wordfence: 100,000+ sites exposedwordfence.com
    security
  5. SentinelOne: CVE-2026-0548 auth bypasssentinelone.com
    security
  6. Freshy: SQL injection CVE-2026-19094freshysites.com
    security
  7. WPScan: IDOR post overwritewpscan.com
    security
  8. Patchstack: broken access control in Propatchstack.com
    security
  9. Rapid7: CVE-2026-14187rapid7.com
    security
  10. Exploit-DB: CSRF CVE-2020-8615exploit-db.com
    security
  11. FormGet: LMS plugin pricing roundupformget.com
    review

Rate this review

Anonymous. You can change your vote.

Loading votes…

Ask a follow-up

Ask if a use case fits. Answers stay inside this report and its sources.

    Comments

    One queue. No replies. Give a display name first. Limit: 7 comments per day.

    Save a name to write a comment.

    No comments yet.