Skip to content
PluginCanary

Tutor LMS

Tutor LMS - eLearning and online course solution
by Themeum · 100,000+ active installs · Checked 4 Nov 2026
Watch

Watch: held back by a low Support score (47 of 100).

78/ 100 Canary Score
Sub-scores for Tutor LMS
Ownership100
Maintenance100
Security60
Support47
Reputation70

How the score works

Quick answers

Is Tutor LMS still maintained?
Yes. Last release 27 Oct 2026, 60 releases in the last 24 months. 27 Oct 2026 · wordpress.org
Who owns Tutor LMS, and has it changed hands?
No change recorded. Main committer themeum since Feb 2019. 4 Nov 2026 · SVN log
Was Tutor LMS removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Tutor LMS safe?
100 known vulnerabilities, all fixed (latest in 4.1.3). Not on the exploited list. 17 Oct 2026 · Wordfence Intelligence
Is the latest Tutor LMS update safe to install?
No ownership change before 4.2.0. No one-star spike after it. 27 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
plugin-master15 Nov 2018 to 15 Nov 2018, 1 commits
themeum6 Feb 2019 to 27 Oct 2026, 262 commits

2 committers recorded. No ownership change since 2018.

Maintenance

Last release
8 days ago
Releases, 24 months
60
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for Tutor LMS
Q1 20243
Q2 20243
Q3 20244
Q4 20245
Q1 20257
Q2 20256
Q3 202511
Q4 20255
Q1 20263
Q2 20267
Q3 202612
Q4 20264

Last release 27 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 3.6 (5 reviews). Lifetime: 4.4.

Average rating per quarter for Tutor LMS
Q1 20253.7
Q2 20254.2
Q3 20252.3
Q4 20253.0
Q1 20262.8
Q2 20263.5
Q3 20263.4
Q4 20262.0

Average rating fell from 3.7 to 2.0 between Q1 2025 and Q4 2026.

Rating distribution
5 star482
4 star13
3 star14
2 star20
1 star61
Latest low reviews

Security record

56 vulnerabilities in 24 months (100 on record), all patched (latest fixed in 4.1.3).

Show 100 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
17 Oct 2026Tutor LMS - eLearning and online course solution <= 4.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4<= 4.1.24.1.3Patched before disclosure
16 Oct 2026Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter4.3<= 4.1.04.1.1Patched before disclosure
15 Oct 2026Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter6.4<= 4.1.04.1.1Patched before disclosure
15 Oct 2026Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter6.1<= 4.0.84.0.9Patched before disclosure
13 Oct 2026Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter4.7<= 4.1.04.1.1Patched before disclosure
13 Oct 2026Tutor LMS <= 4.1.0 - Missing Authorization5.3<= 4.1.04.1.1Patched before disclosure
8 Oct 2026Tutor LMS - eLearning and online course solution <= 4.1.2 - Authenticated (Subscriber+) Race Condition4.3<= 4.1.2Not affectedn/a
8 Oct 2026Tutor LMS 4.0.5 - 4.1.0 - Authenticated (Instructor+) Insecure Direct Object Reference4.34.0.5 to 4.1.04.1.1Patched before disclosure
6 Oct 2026Tutor LMS - eLearning and online course solution <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting7.2<= 4.1.04.1.1Patched before disclosure
21 Sep 2026Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter4.3<= 4.0.74.0.8Patched before disclosure
18 Sep 2026Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters6.1<= 4.0.84.0.9Patched before disclosure
18 Sep 2026Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter4.3<= 4.0.84.0.9Patched before disclosure
18 Sep 2026Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter6.5<= 4.0.84.0.9Patched before disclosure
14 Sep 2026Tutor LMS 2.7.1 - 4.0.7 - REST API Authentication Confusion4.3<= 4.0.74.0.8Patched before disclosure
14 Sep 2026Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) Information Exposure4.3<= 4.0.74.0.8Patched before disclosure
11 Sep 2026Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution8.8<= 4.0.74.0.8Patched before disclosure
28 Aug 2026Tutor LMS - eLearning and online course solution < 4.0.6 - Authenticated (Custom Role+) Arbitrary File Read6.5< 4.0.64.0.6Patched before disclosure
27 Aug 2026Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters6.5<= 4.0.54.0.6Patched before disclosure
26 Aug 2026Tutor LMS <= 4.0.5 - Unauthenticated Arbitrary Zero-Argument Function Invocation9.8<= 4.0.54.0.6Patched before disclosure
24 Aug 2026Tutor LMS - eLearning and online course solution < 4.0.6 - Unauthenticated SQL Injection7.5< 4.0.64.0.6Patched before disclosure
20 Aug 2026Tutor LMS <= 4.0.5 - Authenticated (Instructor+) Insecure Direct Object Reference4.3<= 4.0.54.0.6Patched before disclosure
30 Jul 2026Tutor LMS - eLearning and online course solution < 4.0.0 - Missing Authorization4.3< 4.0.04.0.0Patched before disclosure
27 Jul 2026Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter4.9<= 4.0.14.0.2Patched before disclosure
15 Jul 2026Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array6.5<= 4.0.04.0.1Patched before disclosure
6 Jul 2026Tutor LMS - eLearning and online course solution <= 3.9.13 - Unauthenticated Insecure Direct Object Reference4.3<= 3.9.133.9.14Patched before disclosure

Changelog mentions of security fixes: 3.9.12 (security, vulnerability); 3.9.13 (security, vulnerability); 3.9.15 (security); 4.0.1 (security); 4.0.5 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

47% of 32 support threads resolved in the last 2 months.

Momentum

100,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Tutor LMS
4 May 20262,729
11 May 202610,309
18 May 202635,274
25 May 20268,014
1 Jun 20266,357
8 Jun 202630,845
15 Jun 202633,619
22 Jun 20269,927
29 Jun 202634,407
6 Jul 202679,272
13 Jul 202617,385
20 Jul 202652,708
27 Jul 202635,868
3 Aug 202615,761
10 Aug 202634,364
17 Aug 202656,850
24 Aug 202614,172
31 Aug 20269,733
7 Sep 202631,915
14 Sep 202639,041
21 Sep 202612,703
28 Sep 202630,952
5 Oct 202637,608
12 Oct 202654,347
19 Oct 202614,129
26 Oct 202636,631
2 Nov 20262,282

Weekly downloads over the last 4 weeks are 3% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

LearnPressScore 100 · 10,000+LearnPressScore 98 · 20,000+LifterLMSScore 86 · 10,000+LearnPressScore 85 · 70,000+MasterStudy LMS WordPress PluginScore 83 · 10,000+

Facts

Version4.2.0
AuthorThemeum
Added6 Feb 2019
Last updated27 Oct 2026
Active installs100,000+
Requires WordPress5.3
Tested up to7.1.4
Requires PHP7.4
CategoryLearning Management Systems (LMS) > Course Creation & Management
Tagslms, course, education, elearning, learning management system

Other plugins by this author: Kirki - Freeform Page Builder, Website Builder & Customizer, Tutor LMS Elementor Addons, TutorMate, WP Mega Menu, Qubely - Advanced Gutenberg Blocks, WP Crowdfunding, Tutor LMS - Migration Tool, Tutor LMS BunnyNet Integration, Tutor LMS Divi Modules, Certificate customizer for Tutor LMS, Oxygen Tutor LMS, Growfund - Ultimate Donation & Crowdfunding Solution

Questions

Is Tutor LMS still maintained?

Yes. Last release 27 Oct 2026, 60 releases in the last 24 months.

Who owns Tutor LMS, and has it changed hands?

No change recorded. Main committer themeum since Feb 2019.

Was Tutor LMS removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Tutor LMS safe?

100 known vulnerabilities, all fixed (latest in 4.1.3). Not on the exploited list.

Is the latest Tutor LMS update safe to install?

No ownership change before 4.2.0. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue