The nonce going back and forth is the same, so it must be in this code in the Wordpress plugin
https://github.com/discourse/wp-discourse/blob/ebcd82475d9d2ecbebe97cd9145fc996f1d53eea/lib/sso-client/nonce.php#L131-L180
Off topic: why is this not being oneboxed?
Could it be this issue?
https://meta.discourse.org/t/wordpress-as-sso-client-expired-nonce/62295/15