The nonce going back and forth is the same, so it must be in this code in the Wordpress plugin
Off topic: why is this not being oneboxed?
Could it be this issue?
https://meta.discourse.org/t/wordpress-as-sso-client-expired-nonce/62295/15
إعجاب واحد (1)