
Tutor LMS – eLearning and online course solution Security & Risk Analysis
wordpress.org/plugins/tutorA complete WordPress LMS plugin to create any eLearning website easily.
Is Tutor LMS – eLearning and online course solution Safe to Use in 2026?
Mostly Safe
Score 75/100Tutor LMS – eLearning and online course solution is generally safe to use. 60 past CVEs were resolved. Keep it updated.
The "tutor" plugin v3.9.7 exhibits a mixed security posture. While it demonstrates good practices in areas like SQL prepared statements (91%) and output escaping (95%), significant concerns arise from its substantial unprotected attack surface. A high number of AJAX handlers (98 out of 129) and a REST API route lack proper authentication or permission checks, presenting numerous opportunities for unauthorized access and manipulation.
The static analysis also flags critical vulnerabilities in taint analysis, with 3 high-severity flows identified with unsanitized paths. The presence of `unserialize` is a known dangerous function that can lead to remote code execution if not handled with extreme care and sanitization. The plugin's history is deeply troubling, with a large number of past CVEs, including 2 critical and 15 high-severity vulnerabilities, spanning a wide range of common attack vectors like SQL injection, information exposure, and authorization bypass. The fact that the last vulnerability was so recent (February 2026, despite being in the past) and the absence of currently unpatched CVEs do not negate the systemic issues indicated by the extensive vulnerability history.
In conclusion, despite some positive technical implementations, the "tutor" plugin v3.9.7 is assessed as high risk due to its extensive unprotected entry points, critical taint analysis findings, and a history rife with severe security flaws. The sheer volume of past vulnerabilities suggests a pattern of insecure coding practices that require significant attention and remediation.
Key Concerns
- Large attack surface without auth checks
- High severity taint flows
- Dangerous function 'unserialize' present
- Large number of past critical CVEs (2)
- Large number of past high CVEs (15)
- REST API route without permission callback
- Missing nonce checks on AJAX handlers (implied by unprotected count)
Tutor LMS – eLearning and online course solution Security Vulnerabilities
CVEs by Year
Severity Breakdown
60 total CVEs
Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code
Tutor LMS – eLearning and online course solution <= 3.9.5 - Missing Authorization
Tutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action
Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion
Tutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion
Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification
Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion
Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass
Tutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details
Tutor LMS <= 3.9.4 - Authenticated (Instructor+) Insecure Direct Object Reference
Tutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information Exposure
Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update
Tutor LMS <= 3.7.4 - Authenticated (Administrator+) SQL Injection
Tutor LMS <= 3.4.0 - Authenticated (Subscriber+) HTML Injection
Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter
Tutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registration
Tutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable'
Tutor LMS <= 2.7.2 - Authenticated (Administrator+) SQL Injection
Tutor LMS <= 2.7.3 - Authenticated (Instructor+) Stored Cross-Site Scripting
Tutor LMS <= 2.7.3 - Missing Authorization
Tutor LMS <= 2.7.2 - Cross-Site Request Forgery
Tutor LMS <= 2.7.2 - Authenticated (Tutor Instructor+) Stored Cross-Site Scripting
Tutor LMS <= 2.7.1 - Authenticated (Admin+) Path Traversal
Tutor LMS – eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL Injection
Tutor LMS – eLearning and online course solution <= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion
Tutor LMS – eLearning and online course solution <= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion
Tutor LMS <= 2.7.0 - Authenticated (Instructor+) SQL Injection
Tutor LMS <= 2.7.0 - Missing Authorization
Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update
Tutor LMS – eLearning and online course solution <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcode
Tutor LMS – eLearning and online course solution <= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data Erase
Tutor LMS – eLearning and online course solution <= 2.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection
Tutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&A
Tutor LMS <= 2.6.0 - Missing Authorization
Tutor LMS <= 2.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Tutor LMS <= 2.2.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Tutor LMS <= 2.2.0 - Missing Authorization via REST API
Tutor LMS <= 2.2.0 - Authenticated (Student+) SQL Injection
Tutor LMS <= 2.1.10 - Authenticated (Tutor Instructor+) SQL Injection
Tutor LMS <= 2.1.10 - Unauthenticated SQL Injection
Tutor LMS <= 2.1.8 - Missing Authorization via multiple AJAX actions
Tutor LMS <= 2.0.9 - Reflected Cross-Site Scripting
Tutor LMS <= 2.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
Tutor LMS – eLearning and online course solution 2.0.0-2.0.8 - Reflected Cross-Site Scripting
Tutor LMS <= 1.9.11 - Stored Cross-Site Scripting
Tutor LMS <= 1.9.11 - Reflected Cross-Site Scripting
Tutor LMS <= 1.9.10 - Reflected Cross-Site Scripting
Tutor LMS <= 1.9.8 - Admin+ Stored Cross-Site Scripting
Tutor LMS <= 1.9.5 - Cross-Site Scripting
Tutor LMS <= 1.9.1 - Authenticated Stored Cross-Site Scripting
Tutor LMS <= 1.8.7 - Authenticated Local File Inclusion
Tutor LMS – eLearning and online course solution <= 1.7.6 - Unprotected AJAX including Privilege Escalation
Tutor LMS <= 1.8.2 - SQL Injection via tutor_quiz_builder_get_question_form
Tutor LMS – eLearning and online course solution <=1.7.6 - SQL Injection
Tutor LMS – eLearning and online course solution <= 1.7.6 - SQL Injection
Tutor LMS <=1.8.2 - SQL Injection via tutor_quiz_builder_get_answers_by_question
Tutor LMS <=1.8.2 - SQL Injection via tutor_answering_quiz_question/get_answer_by_id
Tutor LMS <= 1.9.12 - Reflected Cross-Site Scripting
Tutor LMS < 1.5.3 - Cross-Site Request Forgery
Tutor LMS – eLearning and online course solution Code Analysis
Dangerous Functions Found
Bundled Libraries
SQL Query Safety
Output Escaping
Data Flow Analysis
Tutor LMS – eLearning and online course solution Attack Surface
AJAX Handlers 129
REST API Routes 1
Shortcodes 7
WordPress Hooks 308
Scheduled Events 1
Maintenance & Trust
Tutor LMS – eLearning and online course solution Maintenance & Trust
Maintenance Signals
Community Trust
Tutor LMS – eLearning and online course solution Alternatives
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
learnpress
A WordPress LMS Plugin to create WordPress Learning Management System. Turn your WordPress to LMS WordPress Website with Courses, Lessons, Quizzes &am …
MasterStudy LMS WordPress Plugin – for Online Courses and Education
masterstudy-lms-learning-management-system
Learning Management System and eLearning plugin for WordPress. Create easily LMS WordPress website, add and sell Courses, Lessons, Quizzes online.
Masteriyo LMS – Online Course Builder for eLearning, LMS & Education
learning-management-system
The complete WordPress LMS plugin for course creation & monetization. Create engaging courses, lessons, quizzes, assignments & certificates.
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
academy
Academy LMS is the all-rounder among all WordPress LMS plugins. A complete solution, easy to use, feature-rich and provides powerful integrations.
Tutor LMS Divi Modules
tutor-lms-divi-modules
Get 26+ Tutor LMS Divi Page builder widgets to create an entire eLearning site and design custom course pages, course carousels, listings, and more.
Tutor LMS – eLearning and online course solution Developer Profile
14 plugins · 675K total installs
How We Detect Tutor LMS – eLearning and online course solution
Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.
Asset Fingerprints
/wp-content/plugins/tutor/assets/js/webpack-common.js/wp-content/plugins/tutor/assets/js/editor-script.js/wp-content/plugins/tutor/assets/js/frontend-script.js/wp-content/plugins/tutor/assets/css/tutor.css/wp-content/plugins/tutor/assets/css/tutor-frontend.css/wp-content/plugins/tutor/assets/css/elements.css/wp-content/plugins/tutor/assets/css/magnific-popup.css/wp-content/plugins/tutor/assets/js/magnific-popup.js+37 more<meta name="generator" content="Tutor LMS - elearning for WordPress 3.9.7" />/wp-content/plugins/tutor/assets/js/webpack-common.js/wp-content/plugins/tutor/assets/js/editor-script.js/wp-content/plugins/tutor/assets/js/frontend-script.js/wp-content/plugins/tutor/assets/js/magnific-popup.js/wp-content/plugins/tutor/assets/js/moment.min.js/wp-content/plugins/tutor/assets/js/editor.js+34 moretutor/assets/js/webpack-common.js?ver=tutor/assets/js/editor-script.js?ver=tutor/assets/js/frontend-script.js?ver=tutor/assets/css/tutor.css?ver=tutor/assets/css/tutor-frontend.css?ver=tutor/assets/css/elements.css?ver=tutor/assets/css/magnific-popup.css?ver=tutor/assets/js/magnific-popup.js?ver=tutor/assets/js/moment.min.js?ver=tutor/assets/js/editor.js?ver=tutor/assets/js/editor-content.js?ver=tutor/assets/js/editor-lesson.js?ver=tutor/assets/js/editor-quiz.js?ver=tutor/assets/js/editor-assignment.js?ver=tutor/assets/js/editor-modal.js?ver=tutor/assets/js/editor-modal-content.js?ver=tutor/assets/js/editor-modal-lesson.js?ver=tutor/assets/js/editor-modal-quiz.js?ver=tutor/assets/js/editor-modal-assignment.js?ver=tutor/assets/js/frontend.js?ver=tutor/assets/js/course-enroll.js?ver=tutor/assets/js/dashboard.js?ver=tutor/assets/js/quiz-builder.js?ver=tutor/assets/js/lesson-video-preview.js?ver=tutor/assets/js/course-bundle.js?ver=tutor/assets/js/certificate.js?ver=tutor/assets/js/grade-submission.js?ver=tutor/assets/js/common.js?ver=tutor/assets/js/date-fns.min.js?ver=tutor/assets/js/frontend-quiz-attempt.js?ver=tutor/assets/js/tinymce-plugins/media-buttons.js?ver=tutor/assets/js/tinymce-plugins/content-editor.js?ver=tutor/assets/js/tinymce-plugins/lesson-editor.js?ver=tutor/assets/js/tinymce-plugins/quiz-editor.js?ver=tutor/assets/js/tinymce-plugins/assignment-editor.js?ver=tutor/assets/js/tinymce-plugins/modal-editor.js?ver=tutor/assets/js/tinymce-plugins/modal-content-editor.js?ver=tutor/assets/js/tinymce-plugins/modal-lesson-editor.js?ver=tutor/assets/js/tinymce-plugins/modal-quiz-editor.js?ver=tutor/assets/js/tinymce-plugins/modal-assignment-editor.js?ver=tutor/assets/js/admin-bundle.js?ver=tutor/assets/js/tutor-admin.js?ver=tutor/assets/js/tutor-blocks.js?ver=tutor/assets/js/tutor-frontend-editor.js?ver=tutor/assets/css/elementor.css?ver=HTML / DOM Fingerprints
tutor-dashboard-wraptutor-course-buildertutor-course-singletutor-quiz-buildertutor-assignment-submission-wraptutor-frontend-dashboardtutor-admin-pagetutor-course-archive+12 more<!-- Tutor Addon Manager --><!-- Course Builder --><!-- Quiz Builder --><!-- Assignment Submission -->+5 moredata-tutor-course-iddata-tutor-quiz-iddata-tutor-lesson-iddata-tutor-assignment-iddata-tutor-user-iddata-tutor-nonce+4 moretutorTUTOR_CONFIGTutorFrontend/wp-json/tutor/v1/courses/wp-json/tutor/v1/quizzes/wp-json/tutor/v1/assignments/wp-json/tutor/v1/lessons/wp-json/tutor/v1/quiz-attempts/wp-json/tutor/v1/course-enrollments[tutor_course_carousel[tutor_course_grid[tutor_course_list[tutor_instructor_list