Kirki < 6.0.7 - Subscriber+ Sensitive Data Exposure via kirki_wp_admin_get_apis Action

Description

The plugin is vulnerable to authorization bypass via the `kirki_wp_admin_get_apis` AJAX action due to a missing capability check. This makes it possible for authenticated attackers with Subscriber-level access and above to view all frontend forms and read stored visitor form submission data, including contact details and messages.