maybe you can still use RHOSTS in place of TARGET as long as you don't deregister it?  Tho I guess you don't want DNS queries coming from the attacker box, just the WordPress box, if possible.
Well, anyways FYI, RHOSTS gets registered here:  https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/auxiliary/scanner.rb