Skip to content
PluginCanary

Tutor LMS

by Themeum · 100,000+ active installs · Checked 4 Nov 2026
Watch

Watch: held back by a low Support score (47 of 100).

78/ 100 Canary Score

Based on all 5 areas

Sub-scores for Tutor LMS
Ownership100
Maintenance100
Security60
Support47
Reputation70

How the score works

Quick answers

Is Tutor LMS still maintained?
Yes. Last release 27 Oct 2026, 60 releases in the last 24 months. 27 Oct 2026 · wordpress.org
Who owns Tutor LMS, and has it changed hands?
No change recorded. Main committer themeum since Feb 2019. 4 Nov 2026 · SVN log
Was Tutor LMS removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Tutor LMS safe?
100 known vulnerabilities, all fixed (latest in 4.1.3). Not on the exploited list. 17 Oct 2026 · Wordfence Intelligence
Is the latest Tutor LMS update safe to install?
No ownership change before 4.2.0. No one-star spike after it. 27 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

  • InfoSEC-356 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

History: 100 past vulnerabilities, all patched.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
plugin-master15 Nov 2018 to 15 Nov 2018, 1 commits
themeum6 Feb 2019 to 27 Oct 2026, 262 commits

2 committers recorded. No ownership changes recorded since 2018.

Maintenance

Last release
8 days ago
Releases, 24 months
60
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for Tutor LMS
Q1 20243
Q2 20243
Q3 20244
Q4 20245
Q1 20257
Q2 20256
Q3 202511
Q4 20255
Q1 20263
Q2 20267
Q3 202612
Q4 20264

Last release 27 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 3.6 (5 reviews). Lifetime: 4.4.

Last 90 days vs lifetime average rating for Tutor LMS
Last 90 days3.6
Lifetime4.4
Average rating per quarter
Average rating per quarter for Tutor LMS
Q1 20253.7
Q2 20254.2
Q3 20252.3
Q4 20253.0
Q1 20262.8
Q2 20263.5
Q3 20263.4
Q4 20262.0

Average rating fell from 3.7 to 2.0 between Q1 2025 and Q4 2026.

Rating distribution
5 star482
4 star13
3 star14
2 star20
1 star61
Latest low reviews

Security record

56 vulnerabilities in 24 months (100 on record), all patched (latest fixed in 4.1.3).

Show 100 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
17 Oct 2026Tutor LMS - eLearning and online course solution <= 4.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4<= 4.1.24.1.3Before disclosure
16 Oct 2026Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter4.3<= 4.1.04.1.1Before disclosure
15 Oct 2026Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter6.4<= 4.1.04.1.1Before disclosure
15 Oct 2026Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter6.1<= 4.0.84.0.9Before disclosure
13 Oct 2026Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter4.7<= 4.1.04.1.1Before disclosure
13 Oct 2026Tutor LMS <= 4.1.0 - Missing Authorization5.3<= 4.1.04.1.1Before disclosure
8 Oct 2026Tutor LMS - eLearning and online course solution <= 4.1.2 - Authenticated (Subscriber+) Race Condition4.3<= 4.1.2Not affectedn/a
8 Oct 2026Tutor LMS 4.0.5 - 4.1.0 - Authenticated (Instructor+) Insecure Direct Object Reference4.34.0.5 to 4.1.04.1.1Before disclosure
6 Oct 2026Tutor LMS - eLearning and online course solution <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting7.2<= 4.1.04.1.1Same day
21 Sep 2026Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter4.3<= 4.0.74.0.8Before disclosure
18 Sep 2026Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters6.1<= 4.0.84.0.9Before disclosure
18 Sep 2026Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter4.3<= 4.0.84.0.9Before disclosure
18 Sep 2026Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter6.5<= 4.0.84.0.9Before disclosure
14 Sep 2026Tutor LMS 2.7.1 - 4.0.7 - REST API Authentication Confusion4.3<= 4.0.74.0.8Before disclosure
14 Sep 2026Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) Information Exposure4.3<= 4.0.74.0.8Before disclosure
11 Sep 2026Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution8.8<= 4.0.74.0.8Before disclosure
28 Aug 2026Tutor LMS - eLearning and online course solution < 4.0.6 - Authenticated (Custom Role+) Arbitrary File Read6.5< 4.0.64.0.6Before disclosure
27 Aug 2026Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters6.5<= 4.0.54.0.6Before disclosure
26 Aug 2026Tutor LMS <= 4.0.5 - Unauthenticated Arbitrary Zero-Argument Function Invocation9.8<= 4.0.54.0.6Before disclosure
24 Aug 2026Tutor LMS - eLearning and online course solution < 4.0.6 - Unauthenticated SQL Injection7.5< 4.0.64.0.6Before disclosure
20 Aug 2026Tutor LMS <= 4.0.5 - Authenticated (Instructor+) Insecure Direct Object Reference4.3<= 4.0.54.0.6Before disclosure
30 Jul 2026Tutor LMS - eLearning and online course solution < 4.0.0 - Missing Authorization4.3< 4.0.04.0.0Before disclosure
27 Jul 2026Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter4.9<= 4.0.14.0.2Before disclosure
15 Jul 2026Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array6.5<= 4.0.04.0.1Before disclosure
6 Jul 2026Tutor LMS - eLearning and online course solution <= 3.9.13 - Unauthenticated Insecure Direct Object Reference4.3<= 3.9.133.9.14Before disclosure

Changelog mentions of security fixes: 3.9.12 (security, vulnerability); 3.9.13 (security, vulnerability); 3.9.15 (security); 4.0.1 (security); 4.0.5 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

47% of 32 support threads resolved in the last 2 months.

Momentum

100,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Tutor LMS
4 May 20262,729
11 May 202610,309
18 May 202635,274
25 May 20268,014
1 Jun 20266,357
8 Jun 202630,845
15 Jun 202633,619
22 Jun 20269,927
29 Jun 202634,407
6 Jul 202679,272
13 Jul 202617,385
20 Jul 202652,708
27 Jul 202635,868
3 Aug 202615,761
10 Aug 202634,364
17 Aug 202656,850
24 Aug 202614,172
31 Aug 20269,733
7 Sep 202631,915
14 Sep 202639,041
21 Sep 202612,703
28 Sep 202630,952
5 Oct 202637,608
12 Oct 202654,347
19 Oct 202614,129
26 Oct 202636,631
2 Nov 20262,282

Weekly downloads over the last 4 weeks are 3% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score. Never sponsored.

LearnPressScore 95 · 20,000+LearnPressScore 95 · 10,000+LifterLMSScore 86 · 10,000+

Facts

Full nameTutor LMS - eLearning and online course solution
Version4.2.0
AuthorThemeum
Added6 Feb 2019
Last updated27 Oct 2026
Active installs100,000+
Requires WordPress5.3
Tested up to7.1.4
Requires PHP7.4
CategoryLearning Management Systems (LMS) > Course Creation & Management
Tagslms, course, education, elearning, learning management system

Other plugins by this author: Kirki, Tutor LMS Elementor Addons, TutorMate, WP Mega Menu, Qubely, WP Crowdfunding, Tutor LMS, Tutor LMS BunnyNet Integration, Tutor LMS Divi Modules, Certificate customizer for Tutor LMS, Oxygen Tutor LMS, Growfund

Questions

Is Tutor LMS still maintained?

Yes. Last release 27 Oct 2026, 60 releases in the last 24 months.

Who owns Tutor LMS, and has it changed hands?

No change recorded. Main committer themeum since Feb 2019.

Was Tutor LMS removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Tutor LMS safe?

100 known vulnerabilities, all fixed (latest in 4.1.3). Not on the exploited list.

Is the latest Tutor LMS update safe to install?

No ownership change before 4.2.0. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue