LoginSign Up
← Back to all sparks
L

LifterLMS

EDTECH
Velocity6.3

WordPress LMS plugin for creating and selling online courses with memberships, quizzes, and certificates.

lifterlms.com ↗

A WordPress LMS that just made its whole REST surface discoverable to AI clients.

wordpresslmsabilities-apiai-agentswp-clisecurity-hardening
◆Current state
LifterLMS spent June on a run of security-only patches — checkout order creation, quiz start, REST authentication, import user creation, each crediting an outside reporter — before shipping 10.1.0, which registers its REST endpoints for courses, sections, lessons, memberships, access plans, students, enrollments and progress as WordPress Abilities API abilities. That release also added wp llms CLI commands for course enrollments and course structure, and shipped a docs/ai-agents.md guide naming Claude Code, Cursor and Codex as intended clients. The 10.1.1 follow-up is bug fixes plus more entropy in generated order keys.
◆Where it's heading
The direction is clear from what got built around the Abilities API integration: not just the registration, but CLI commands that return a whole course structure in one call and a written guide for driving the plugin from an agent. That is a plugin being deliberately shaped for machine operation rather than exposing an API and hoping. Running underneath it is a sustained security pass — the June patches plus the order-key entropy fix — which is the necessary counterpart to opening the surface up.
◆Prediction
Expect the AI-agent documentation and CLI commands to expand faster than the web UI, since the recent releases put more new capability behind wp llms and the abilities registry than in the admin.

◆Recent moves

  1. 20h ago

    10.1.1: order key entropy plus Course Builder and block editor fixes

    A cleanup release a week after 10.1.0: more entropy in order keys, and fixes for access plans not saving from the block editor, duplicate engagement emails when multiple emails share a trigger, and lesson completion rejected at the exact moment the minimum time requirement was met. The mix of a hardening item with editor bugs matches the pattern of the last several months.

    View source ↗
  2. 7d ago

    10.1.0: REST endpoints registered as WordPress Abilities for AI clients

    ⚡ SPARK

    The release that turns LifterLMS into something an agent can operate: every major REST endpoint registered as a discoverable ability under WordPress 6.9's Abilities API, plus wp llms commands that return course structure and enrollments in one call and a written guide for Claude Code, Cursor and Codex. It reframes the plugin from a site feature into a data surface other software drives.

    View source ↗
  3. 1mo ago

    10.0.10: pricing markup sanitization and post-search AJAX checks

    Two externally reported security fixes covering pricing display markup and post search AJAX requests. Part of the June hardening run that precedes opening the REST surface to agents.

    View source ↗
  4. 1mo ago

    10.0.9: tighter checks on quiz start and REST authentication

    Additional checks when starting a quiz, on the add-ons screen, and when authenticating REST API requests. The REST authentication item is directly relevant to what 10.1.0 would later expose.

    View source ↗
  5. 1mo ago

    10.0.8: checkout, import and registration form validation

    Three security fixes from a single outside reporter covering checkout order creation, user creation during imports, and account and registration form submissions. All on paths that create records rather than read them.

    View source ↗
  6. 1mo ago

    10.0.7: anonymous visitors no longer break full-page caching

    Session cookies are withheld from anonymous visitors until session data is actually written, so ordinary page views stay eligible for full-page caching instead of bypassing it. A real throughput change for content-heavy course sites, bundled with more input validation fixes.

    View source ↗