You'll need three hooks:
1: user_register
This is for when the user is created via the admin back-end. The username will be available via $_POST['user_login']
and the password will be available via $_POST['pass1']
.
2: edit_user_profile_update
This is for when the password is updated on the profile page by the user or admin. The username will be available via $_POST['user_login']
and the password will be available via $_POST['pass1']
.
3: password_reset
This is for when the user resets their password using the forgot password page. The username will be available via the first argument $user
using $user->user_login
. The password will be available via the second argument $new_pass
.
In terms of getting the old password, I don't think you can. The password is hashed and stored in the database. You have access to the hash, but you can't reconstruct the old password from it.
The only option you have there is to store the password somewhere else in an encrypted way so you can retrieve it later and decrypt it, however this method is not recommended from a security point of view.
I'd recommend finding a way to update the password in cPanel without having the old password.