LoginSign Up
← Back to all sparks
L

LifterLMS

EDTECH
Velocity6.3

WordPress LMS plugin for creating and selling online courses with memberships, quizzes, and certificates.

lifterlms.com ↗

LifterLMS is wiring its whole LMS into WordPress's abilities registry, endpoint by endpoint.

lmswordpressabilities-apirest-apiai-agentscertificates
◆Current state
10.1.0 registered the core REST surface — courses, sections, lessons, memberships, access plans, students, enrollments, progress — as WordPress Abilities API abilities. 10.2.0 extends that to the commercial and assessment halves: quizzes, quiz questions, quiz attempts including grading, orders and transactions, certificate templates and awarded certificates, each with webhook topics and ability registration. It also adds a read-only student grades endpoint with per-lesson breakdowns and time-limited signed download URLs for protected media. Before this arc, the releases were almost entirely security hardening — checkout, imports, registration forms, REST authentication.
◆Where it's heading
The direction is unambiguous: make every part of the LMS reachable by an agent through a standard registry rather than a bespoke integration. The refinements in 10.2.0 confirm it is being taken seriously as an interface — ability schemas now reject unknown parameters instead of ignoring them, list abilities return empty collections rather than errors, and rendered markup is omitted where a raw field exists to cut payload size. Bundling the blocks, CLI, helper and REST plugins into core in 10.1.0 removed the version-skew problem that would otherwise make this surface unreliable.
◆Prediction
The remaining unregistered areas — engagements, notifications, reporting exports — are the likely next abilities. Payload and schema tightening looks set to continue as real agent traffic exposes rough edges.

◆Recent moves

  1. 22d ago

    10.2.0 extends REST and abilities coverage to quizzes, orders and certificates

    Widens the agent-reachable surface established in 10.1.0 to assessment and commerce — quiz attempts with grading, orders and transactions, certificate templates and awards — plus a student grades endpoint and signed download URLs for protected files. The schema tightening alongside it, rejecting unknown parameters and trimming rendered markup, reads as a surface being prepared for real automated traffic.

    View source ↗
  2. 1mo ago

    10.1.1: order key entropy plus Course Builder and block editor fixes

    A cleanup pass after the 10.1.0 feature release: more entropy in generated order keys, access plans saving correctly from the block editor, and duplicate engagement emails stopped. Also adds authorization checks on REST API key and webhook admin actions.

    View source ↗
  3. 1mo ago

    10.1.0: REST endpoints registered as WordPress Abilities for AI clients

    ⚡ SPARK

    The origin of the abilities arc — every subsequent release extends or refines the surface this one opened.

    View source ↗
  4. 2mo ago

    10.0.10: pricing markup sanitization and post-search AJAX checks

    A security-only release crediting two external reporters, covering pricing display markup and post search AJAX requests. One of a run of such releases that preceded the abilities work.

    View source ↗
  5. 2mo ago

    10.0.9: tighter checks on quiz start and REST authentication

    Adds authorization checks when starting a quiz, on the add-ons screen and during REST authentication, plus a block editor dialog scroll fix. The REST hardening here is what the abilities surface was later built on top of.

    View source ↗
  6. 2mo ago

    10.0.8: checkout, import and registration form validation

    Three externally reported security fixes covering checkout order creation, user creation during course imports, and account and registration form submission. Routine but concentrated on the paths that touch money and account creation.

    View source ↗