shouldiuse.io

Categories

VERDICT

Tutor LMS | Most Powerful WordPress LMS Plugin Review

Depends

Should I use Tutor LMS | Most Powerful WordPress LMS Plugin?

Planning to launch an eLearning site? FREE download Tutor LMS, the most powerful WordPress LMS plugin to kickstart your online classroom. Learning management system for all! - tutorlms.com

· 1 month ago

Buy if you run WordPress, can commit to fast plugin patching, and want a free-to-start course platform. Avoid if you hold sensitive learner data or want a hosted, maintenance-free LMS.

Confidence

Medium. Based on 14 public sources; security coverage is deep, pricing data is thin and dated.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support quality
  • Security posture

Pricing

$0

Free

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Pro add-ons$99/site (2022 third-party listing)

Best for

  • Solo tutors selling courses on WordPress
  • Course marketplaces with multiple instructors
  • Budget creators wanting a free core
  • Teams comfortable managing plugin updates

Not for

  • Anyone storing sensitive learner or payment data — the security record is rough
  • Non-WordPress sites
  • Buyers wanting hands-off hosted LMS with vendor-managed security
  • Enterprises needing SLAs and security compliance guarantees

Gotchas - check before you buy

high

Versions before 4.0.6 have known unauthenticated SQL injection and ownership-check gaps. Patch immediately.

medium

Official pricing is buried; third-party data cites $99/site and may be stale. Confirm before buying.

medium

Marketplace features and advanced content security are premium-only, not in the free core.

low

Reviewers report hitting bugs, though support resolved them.

Pros and cons

Pros

  • Free core plugin with full course toolkit
  • Lessons, quizzes, notes, live sessions in one continuous space
  • Multi-instructor marketplace with publish approval controls
  • Course videos restricted to enrolled students only
  • Users report support fixes bugs quickly

Cons

  • Five-plus 2026 CVEs including auth bypass and SQL injection
  • One flaw exposed 100,000+ sites to code execution
  • Pro version separately flagged for broken access control
  • No dedicated security page on official site
  • Older version had CSRF flaw letting attackers add users

Sources & method

- 11 sources - Poor track record: at least five 2026 CVEs including authentication bypass and unauthenticated SQL injection.

official x1review x3security x7
  • PHP Object Injection (2026), Affected more than 100,000 WordPress sites per Wordfence Argus.
  • CVE-2026-0548, Authentication bypass vulnerability in the plugin.
  • CVE-2026-19094, Unauthenticated SQL injection in versions before 4.0.6.
  • CVE-2026-14187 / CVE-2026-12274, Missing per-object ownership checks and IDOR letting instructors overwrite posts; fixed in 4.0.6 / 3.9.13.
  • CVE-2020-8615, CSRF in v1.5.3 allowed attackers to add users.

Key stats

  • Value for money: 4/5

    Rating

  • $0

    Starting price

  • 11

    Sources

  • Analyzed

  • Value for money: 4/5. Free core; pro add-ons roughly $99/site
  • Ease of use: 4/5. Lessons, quizzes, progress flow in one space
  • Feature depth: 4/5. Quizzes, live sessions, multi-instructor marketplace tools
  • Support quality: 4/5. User reports bugs fixed quickly by support
  • Security posture: 1/5. Repeated 2026 CVEs including auth bypass and SQLi
  • Yes Free version Core plugin on WordPress.org
  • $99/site Pro add-ons price Third-party 2022 listing, unverified
  • 5+ 2026 CVEs Auth bypass, SQLi, IDOR disclosed
  • 100,000+ Sites exposed By one PHP object injection flaw

Pricing

Free

$0

  • Core LMS plugin on WordPress.org
  • Create and sell basic courses

Pro add-ons

$99/site (2022 third-party listing)

  • Marketplace and advanced quiz features
  • Verify current pricing — listing may be stale

Security

Poor track record: at least five 2026 CVEs including authentication bypass and unauthenticated SQL injection.

  • PHP Object Injection (2026)Affected more than 100,000 WordPress sites per Wordfence Argus.⁴
  • CVE-2026-0548Authentication bypass vulnerability in the plugin.⁵
  • CVE-2026-19094Unauthenticated SQL injection in versions before 4.0.6.⁶
  • CVE-2026-14187 / CVE-2026-12274Missing per-object ownership checks and IDOR letting instructors overwrite posts; fixed in 4.0.6 / 3.9.13.⁹
  • CVE-2020-8615CSRF in v1.5.3 allowed attackers to add users.10

What users say

WordPress.org reviewers praise the feature set and responsive support while acknowledging occasional bugs.

“After hours and hours of research and trying several LMS platforms, I have decided to purchase Tutor LMS. I've run into some bugs, but they were quickly solved by their customer support team.”
WordPress.org plugin reviews, nowhereman78
Full analysis

Based on 14 public sources; security coverage is deep, pricing data is thin and dated.

Powerful free WordPress LMS, but a messy 2026 security record means you must patch fast or pick a hosted option.

Methodology

Based on 14 public sources; security coverage is deep, pricing data is thin and dated.

Read how a report is made.

Sources

  1. Tutor LMS official sitetutorlms.com
    official
  2. Tutor LMS on WordPress.orgwordpress.org
    review
  3. Tutor LMS feature reviewfahimm.com
    review
  4. Wordfence: 100,000+ sites exposedwordfence.com
    security
  5. SentinelOne: CVE-2026-0548 auth bypasssentinelone.com
    security
  6. Freshy: SQL injection CVE-2026-19094freshysites.com
    security
  7. WPScan: IDOR post overwritewpscan.com
    security
  8. Patchstack: broken access control in Propatchstack.com
    security
  9. Rapid7: CVE-2026-14187rapid7.com
    security
  10. Exploit-DB: CSRF CVE-2020-8615exploit-db.com
    security
  11. FormGet: LMS plugin pricing roundupformget.com
    review

Add this review to your site

This check for Tutor LMS | Most Powerful WordPress LMS Plugin says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends Tutor LMS | Most Powerful WordPress LMS Plugin Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.