What about enabling
the UseCanonicalName setting on Apache to enforce a static SERVER_NAME value to ensure it doesn’t get modified
? See https://threatpost.com/unpatched-wordpress-password-reset-vulnerability-lingers/125421/