Wow. That’s a requirement that you should not agree to via email or verbally. You need to write a requirement spec and get their approval. This has all the makings of a client / supplier mismatch (delivering what you think they asked for and then having them not pay because it isn’t what they want or think they want).
This is a requirement from someone who thinks they understand technology but don’t.
As I suspected…they want to drive the world out of their CRM (Zoho) user database. This is a clash of user databases…Zoho and WordPress. Which is the master that the other synchs to and what software will synch them.
The comment “We just need somewhere for the client to be able to change password.” is confusing. If the user database is the Zoho database then password resets go through Zoho. What are they using the WordPress site for! How does S2Member fit into this!
You can control a WordPress site via REST API. If they want to control access to a WordPress portal via Zoho then the registration process is via Zoho and access to the WordPress portal is by adding / removing people from the WordPress user database via REST API.
I think that you need to go back to the start with this one. I still can’t figure out what solution you and your client are trying to create to solve what problem.
I wish you luck though. If it was me I would either drop the client or start a documented requirement process. In any case I wouldn’t do this job for under $5K with a $2K / year maintenance and a liability waiver clause in the contract.
Just some words of wisdom. Feel free to ignore