CiviCRM cron user rejected after update to 4.7.27
I'd try to run CiviCRM cron via the CLI. If your webhosting has CLI access, you can do this using wp-cli or cv. Both will let you execute CiviCRM's scheduled jobs. See Managing Scheduled Jobs > Command Line Syntax for setup instructions.

I can't say why you're running into issues, and I don't know why you'd have started having issues at the upgrade of 4.7.27 - that's worth looking into (and could be worth debugging - you'd start by checking the input variables are correct when that error is thrown in CRM_Utils_System::authenticateScript()).

It could be that WordFence is playing a part in this. CiviCRM's URL cron method involves putting the username and password into GET parameters, which isn't generally a recommended practice (those details can be leaked from GET, see note here). It wouldn't surprise me if WordFence detected and removed sensitive variables in GET params; another possibility is that WordFence might block a user if it detected them logging in every few minutes (as could be happening with URL cron). This is speculation; I don't know WordFence at all.

If CLI cron is available to you, that approach might mitigate this situation, and would at least avoid the possibility of leaking your CiviCRM scheduled job user credentials. It's not a guaranteed fix and I do recommend a shot at debugging what's actually happening, especially if it means resolving some new bug that's sneaked into 4.7.27!

(This isn't a very certain answer, but I hope it helps!)