Moodle 4.1 and 4.4 Are End-of-Life: Your Three Upgrade Paths (and What Each Costs)
Security support for both branches ended December 8, 2025. Here's how to check what you're running, what unpatched actually risks, and how to pick between 4.5 LTS, 5.x, or leaving Moodle — with honest numbers for each.
The clock ran out
On December 8, 2025, Moodle™ 4.1 and 4.4 both dropped off security support on the same day. If your site runs either branch, every vulnerability disclosed since then is patched upstream — and not in your codebase. That's not a "someday" problem. Moodle publishes the details of every fixed vulnerability about a week after the patch ships, which means attackers get a documented roadmap into your unpatched site roughly seven days after every release cycle.
Here's where every currently-relevant branch stands (source: endoflife.date/moodle):
| Branch | Type | Security support | Where that leaves you |
|---|---|---|---|
| Moodle 4.1 | LTS | Ended Dec 8, 2025 | Unpatched. Upgrade now. |
| Moodle 4.4 | Standard | Ended Dec 8, 2025 | Unpatched. Upgrade now. |
| Moodle 4.5 | LTS | Supported to Oct 2027 | The default destination |
| Moodle 5.0 | Standard | Ends Oct 2026 | Shorter runway than 4.5 LTS |
Read that table twice, because it contains the strangest fact in this whole situation: 5.0 goes end-of-support a full year before 4.5 LTS does. Newer is not longer-lived here. That single fact should shape which path you pick below.
Get a free Moodle health check
20 minutes, no obligation. Fixed-quote upgrades from $1,200. We reply within 1 business hour.
What running an unpatched Moodle actually risks
"Security EOL" sounds abstract, so let's be concrete about what past Moodle patch cycles have fixed. These are the vulnerability classes that have shown up in real releases, not hypotheticals:
- Remote code execution. The calculated question type — which evaluates math formulas server-side — has been an RCE vector more than once, most recently in the August 2024 patch cycle. An attacker with a teacher-level account (or a compromised one) could run arbitrary code on your server. That's not "someone sees a grade they shouldn't." That's your whole box.
- Authentication bypass. Past releases have patched flaws in SSO and auth plugins that let attackers log in as other users without credentials. On a site full of minors' records, this is the FERPA nightmare scenario.
- IDOR and privilege escalation. The steady drumbeat of every patch cycle: students reading other students' submissions, non-editing roles gaining editing capabilities, enrolment-check gaps.
The part most people miss: because Moodle discloses fixed vulnerabilities publicly on a schedule, staying unpatched gets worse over time at a known rate. Every two months, another batch of documented, weaponizable flaws applies to your site and will never be fixed there.
If you hold student records, this is also a compliance problem. FERPA doesn't name specific software versions, but "we knowingly ran a platform with published, unpatched vulnerabilities" is a hard position to defend after a breach. Our compliance page covers how we handle FERPA-aware work, including a DPA template your counsel can start from.
How to check which version you're running
Two ways, one minute each:
- In the browser: log in as admin, go to Site administration → Notifications. Your exact version (e.g. "Moodle 4.4.3+") is printed at the bottom of the page.
- On the server: open
version.phpin your Moodle root and read the$releaseline:
$ grep "\$release" /var/www/moodle/version.php
$release = '4.1.15 (Build: 20250113)';Anything starting with 4.1, 4.2, 4.3, or 4.4 is now unsupported (4.2 and 4.3 went EOL even earlier). If you see 3.x — we're glad you're sitting down already, and the path section below still applies to you, with one extra hop.
Path 1: In-place upgrade to 4.5 LTS — the sane default
For probably 80% of sites, this is the answer. Moodle 4.5 is a Long Term Support release, patched until October 2027, and the jump from 4.1 or 4.4 is evolutionary — same course formats, same gradebook, no retraining storm for your teachers.
The gotchas, because there are always gotchas:
- PHP 8.1 is the floor. Moodle 4.1 happily ran on PHP 7.4; Moodle 4.5 requires 8.1 minimum (8.3 supported). If your server is Ubuntu 20.04 with stock PHP 7.4, the "Moodle upgrade" quietly becomes an OS upgrade too. This is the single most underestimated line item we see.
- Database minimums moved. 4.5 wants MySQL 8.0, MariaDB 10.6.7, or PostgreSQL 13 at minimum. Older managed hosting plans frequently fail this check.
- You must be on 4.1.2 or later to jump directly. On 4.1.0 or 4.1.1, take the small point-release step first. On 3.x, the route is 3.9 → 4.1 → 4.5 — two upgrade passes, and yes, that's tedious, and no, there's no shortcut.
- Audit plugins before touching anything. Every third-party plugin needs a 4.5-compatible version in the plugin directory, or a plan for living without it. Do this first; it's the step that turns a smooth afternoon into a bad week when skipped.
Effort and cost: a small, mostly-vanilla site is genuinely a DIY afternoon — full backup, plugin check, staging run, go. Sites with custom themes, a dozen plugins, or years of grade history are where it gets real. We quote these fixed-price from $1,200, and we verify mdl_grade_grades_history row counts before and after so grade data provably survives — see published pricing.
Path 2: Leapfrog to 5.x
Moodle 5.0 shipped in April 2025 with a reworked course experience and, under the hood, the jump from Bootstrap 4 to Bootstrap 5. That last part is the expensive part: any custom theme or plugin template using Bootstrap 4 markup (data-toggle attributes, old grid classes) breaks visually and needs rework. Theme fixes are the bulk of most 5.x quotes — our development page has the bands.
And remember the table above: 5.0's support ends October 2026 — before 4.5 LTS's does. Choosing 5.x today means committing to point-release upgrades every six months until the next LTS lands, likely 5.3 in late 2026.
When it's worth it anyway: you have in-house Moodle competence and stay current as a habit; you specifically want the 5.x course-page UX; or you're mid-redesign and the theme rework is happening regardless. Otherwise, we think leapfrogging is a mistake for most institutions right now. Take 4.5, breathe until 2027, evaluate 5.3 LTS when it's mature.
Path 3: Leave Moodle entirely
Honest advice, even though we're a Moodle shop: a forced upgrade is the right moment to ask whether Moodle still fits. If your admin burden is the real complaint — patching, PHP versions, plugin roulette — the fix might be managed hosting from $79/mo rather than a new platform. But if your team uses 10% of Moodle and dreads the other 90%, migrating to something simpler can be the honest call.
What that costs: agencies typically charge $2,000–$8,000 for LMS migrations. We do them from $1,200 for small sites, $2,500–$4,500 mid-size, in or out of Moodle — Canvas, Blackboard, Brightspace, whichever direction — with the same zero-data-loss guarantee and byte-for-byte row-count verification. If your SCORM packages are half the reason you're frustrated, that's often a $350 repair, not a platform problem.
The upgrade-readiness checklist
Run this yourself before anyone (including us) touches your production site. Each item is an hour or less:
Record your exact version from Site administration → Notifications, including the build number.
Check PHP and database versions against 4.5's floors: PHP 8.1+, MySQL 8.0 / MariaDB 10.6.7 / PostgreSQL 13+. Site administration → Server → Environment does this check for you — set the target to 4.5 in the dropdown.
List every third-party plugin (Site administration → Plugins → Plugins overview, "Additional plugins" filter) and confirm each has a 4.5 release in moodle.org's plugin directory. Flag the ones that don't.
Take a real backup and prove it restores. Database dump plus moodledata plus code. A backup you've never restored is a hope, not a backup.
Snapshot your grade-history row counts (SELECT COUNT(*) FROM mdl_grade_grades_history; and the same for mdl_scorm_scoes_track). After the upgrade, the numbers should match exactly. This is the five-minute step almost nobody does, and it's the one that catches silent data loss.
Rehearse on staging first. Clone the site, run the upgrade there, click through a course, a quiz attempt, and the gradebook as a student and a teacher. Never debut an upgrade in production.
If every box checks cleanly and your site is small, honestly — you can do this yourself in an afternoon. That's not a sales tactic; it's just true.
Frequently asked questions
Is it dangerous to keep running Moodle 4.1 or 4.4 for a few more months?
Each two-month patch cycle publicly documents new vulnerabilities that will never be fixed on your branch, so risk compounds on a schedule. A few weeks while you plan properly is defensible; drifting into 2027 is not, especially with student records under FERPA.
Can I upgrade straight from Moodle 3.9 or 3.11 to 4.5?
Not in one hop. Moodle 4.5 requires 4.1.2 or later as the starting point, so from 3.x you upgrade to 4.1 first (which accepts 3.9+), then to 4.5. Two passes, two rounds of testing.
What PHP version does Moodle 4.5 need?
PHP 8.1 minimum, with 8.3 supported. Moodle 5.0 raises the floor to 8.2. If your server still runs PHP 7.4, budget for a PHP (and possibly OS) upgrade as part of the project — it's the most commonly missed line item.
Will my plugins and custom theme survive the upgrade?
Most mainstream plugins have 4.5 releases; audit each one in the plugin directory before you start. Custom themes usually survive 4.1→4.5 with minor fixes, but the 5.x jump to Bootstrap 5 breaks Bootstrap 4-based themes and typically requires real rework.
How much downtime does a Moodle upgrade cause?
With a staging rehearsal done, the production window is typically 1–3 hours for a mid-size site: maintenance mode on, backup, code swap, database upgrade, smoke test. We schedule these overnight or on weekends so learners never notice.
Should I just wait for the next LTS (5.3) instead of upgrading now?
No. 5.3 LTS isn't expected until late 2026, and 4.1/4.4 are unpatched today. Upgrade to 4.5 LTS now, which is supported to October 2027 — that window comfortably covers evaluating 5.3 once it has a few point releases behind it.
Where we come in
We do fixed-quote Moodle upgrades — no hourly meter running while a migration script misbehaves. From $1,200, including the plugin audit, a staging rehearsal, the production window, and a verification report showing your grade history row counts match before and after. If we miss anything, we fix it free, and every project includes 30 days of post-move support.
Get a free Moodle health check
We reply within 1 business hour. Prefer to talk it through? Call (615) 396-7139.