When is wp_set_password() called or how to capture a password

Question

Disclaimer: I'm fully aware of the security issues created by this. This is not for production.

Whenever a new user is registered or a password is (re)set in WordPress I'm attempting to also capture that password, encrypt it, and save it to the wp_usermeta table.

I've had success hooking into the profile_update action to accomplish this, but the above process only works if a password is changed from the profile page and does not account for new user registrations.

add_action( 'profile_update', 'save_encrypted_passwords_to_usermeta' );

function save_encrypted_passwords_to_usermeta( $user_id ) {
    if ( isset( $_POST['pass1'] ) ) {
        $password = $_POST['pass1'];
        update_user_meta( $user_id, 'password', $password );
    }
}

I've looked to the pluggable function wp_set_password() to accomplish this and have created this muplugin which doesn't seem to work at all.

function wp_set_password( $password, $user_id ) {
    global $wpdb;
    $hash = wp_hash_password( $password );
    $wpdb->update($wpdb->users, array('user_pass' => $hash, 'user_activation_key' => ''), array('ID' => $user_id) );
    update_user_meta( $user_id, 'password', $password );
    wp_cache_delete($user_id, 'users');
}

I'm assuming wp_set_password is always called when a password is created or set so I'm not sure why my pluggable function override is not at all working.

Answer 1

No, I would expect wp_user_update to have been what gets used, but I find your motives dubious, and cannot think of a reasonable use for what you want to do

But if you really want to go down this path, use the pre_user_pass filter.

I would also note that there is a reason why passwords are stored as hashes, rather than encrypted, and your code has no encryption mechanism