If I convert it I get 26 digits
No, you're right. Not every combination of the words results in a 27 digit number. PhemexBTCETHXRP gives 27 characters, while BTCETHXRPPhemex only gives 26. I didn't actually bother to check which combinations were 26 and which were 27, it would have taken longer to do that than it took to just automatically check them all as I did.
Also, shouldn't it be hexadecimal for WIF?
No, WIF is Base58Check. The "standard" private key format is hex.