The reason for the error 403 is that it is not sending headers. Since you are making a CORS request, you can not send any custom header unless the server enables these headers by adding Access-Control-Allow-Headers
to the response.
In a pre-selected request, the client makes 2 requests to the server. The first is pre-verification (with the OPTION method) and the second is the actual request. The server sends the Access-Control-Allow-Headers header in response to the preflight request. Therefore, it allows the sending of some headers. This way, your POST request can work, because the POST request is a prior request. But for a GET request, there is no pre-verification to gather the Access-Control-Allow-Headers header. Then, the browser does not send your custom headers.
A solution:
Add in your php admin-ajax.php
file before printing anything with the, example:
header('Access-Control-Allow-Origin: *');
echo json_encode($resultado);