diff --git src/wp-includes/rest-api.php src/wp-includes/rest-api.php
index 1a7da17..cea7218 100644
--- src/wp-includes/rest-api.php
+++ src/wp-includes/rest-api.php
@@ -825,6 +825,21 @@ function rest_validate_request_arg( $value, $request, $param ) {
 		}
 	}
 
+	// Handle enum arrays.
+	if ( 'array' === $args['type'] && ! empty( $args['items']['enum'] ) && ! empty( $args['items']['type'] ) && 'string' === $args['items']['type'] ) {
+		$values = wp_parse_slug_list( $value );
+		$wrong_params = array();
+		foreach ( $values as $val ) {
+			if ( ! in_array( $val, $args['items']['enum'], true ) ) {
+				$wrong_params[] = $val;
+			}
+		}
+
+		if ( count( $wrong_params ) > 0 ) {
+			return new WP_Error( 'rest_invalid_param', sprintf( /* translators: 1: parameter, 2: list of valid values */ __( '%1$s contains values not of %2$s.' ), $param, implode( ', ', $args['items']['enum'] ) ) );
+		}
+	}
+
 	if ( 'integer' === $args['type'] && ! is_numeric( $value ) ) {
 		return new WP_Error( 'rest_invalid_param', sprintf( /* translators: 1: parameter, 2: type name */ __( '%1$s is not of type %2$s.' ), $param, 'integer' ) );
 	}
diff --git src/wp-includes/rest-api/class-wp-rest-server.php src/wp-includes/rest-api/class-wp-rest-server.php
index 391f549..957a436 100644
--- src/wp-includes/rest-api/class-wp-rest-server.php
+++ src/wp-includes/rest-api/class-wp-rest-server.php
@@ -1181,6 +1181,14 @@ class WP_REST_Server {
 					if ( isset( $opts['description'] ) ) {
 						$arg_data['description'] = $opts['description'];
 					}
+					if ( isset( $opts['items'] ) ) {
+						if ( isset( $opts['items']['enum'] ) ) {
+							$arg_data['items']['enum'] = $opts['items']['enum'];
+						}
+						if ( isset( $opts['items']['type'] ) ) {
+							$arg_data['items']['type'] = $opts['items']['type'];
+						}
+					}
 					$endpoint_data['args'][ $key ] = $arg_data;
 				}
 			}
diff --git src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php
index 6812c13..64f5933 100644
--- src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php
+++ src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php
@@ -1905,9 +1905,12 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
 		$params['status'] = array(
 			'default'           => 'publish',
 			'description'       => __( 'Limit result set to posts assigned a specific status; can be comma-delimited list of status types.' ),
-			'enum'              => array_merge( array_keys( get_post_stati() ), array( 'any' ) ),
-			'sanitize_callback' => 'sanitize_key',
-			'type'              => 'string',
+			'sanitize_callback' => 'wp_parse_slug_list',
+			'type'              => 'array',
+			'items'             => array(
+				'enum' => array_merge( array_keys( get_post_stati() ), array( 'any' ) ),
+				'type' => 'string',
+			),
 			'validate_callback' => array( $this, 'validate_user_can_query_private_statuses' ),
 		);
 		$params['filter'] = array(
@@ -1946,7 +1949,8 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
 	 * @return WP_Error|boolean
 	 */
 	public function validate_user_can_query_private_statuses( $value, $request, $parameter ) {
-		if ( 'publish' === $value ) {
+		// "publish" and array( "publish" ) are equivalent, and always queryable.
+		if ( 'publish' === $value || is_array( $value ) && count( 1 === $value ) && in_array( 'publish', $value, true ) ) {
 			return rest_validate_request_arg( $value, $request, $parameter );
 		}
 		$post_type_obj = get_post_type_object( $this->post_type );
diff --git tests/phpunit/tests/rest-api/rest-posts-controller.php tests/phpunit/tests/rest-api/rest-posts-controller.php
index dd86f94..d1c1d59 100644
--- tests/phpunit/tests/rest-api/rest-posts-controller.php
+++ tests/phpunit/tests/rest-api/rest-posts-controller.php
@@ -248,6 +248,36 @@ class WP_Test_REST_Posts_Controller extends WP_Test_REST_Post_Type_Controller_Te
 		$this->assertErrorResponse( 'rest_invalid_param', $response, 400 );
 	}
 
+	public function test_get_items_multiple_status_query() {
+		wp_set_current_user( 0 );
+		$this->factory->post->create( array( 'post_status' => 'draft' ) );
+
+		$request = new WP_REST_Request( 'GET', '/wp/v2/posts' );
+		$request->set_param( 'status', array( 'publish' ) );
+		$response = $this->server->dispatch( $request );
+		$this->assertEquals( 200, $response->get_status() );
+		$this->assertEquals( 1, count( $response->get_data() ) );
+
+		$request = new WP_REST_Request( 'GET', '/wp/v2/posts' );
+		$request->set_param( 'status', array( 'draft', 'post' ) );
+		$response = $this->server->dispatch( $request );
+		$this->assertErrorResponse( 'rest_invalid_param', $response, 400 );
+
+		wp_set_current_user( $this->editor_id );
+
+		$request = new WP_REST_Request( 'GET', '/wp/v2/posts' );
+		$request->set_param( 'status', 'draft,publish' );
+		$response = $this->server->dispatch( $request );
+		$this->assertEquals( 200, $response->get_status() );
+		$this->assertEquals( 2, count( $response->get_data() ) );
+
+		$request = new WP_REST_Request( 'GET', '/wp/v2/posts' );
+		$request->set_param( 'status', array( 'draft', 'publish' ) );
+		$response = $this->server->dispatch( $request );
+		$this->assertEquals( 200, $response->get_status() );
+		$this->assertEquals( 2, count( $response->get_data() ) );
+	}
+
 	public function test_get_items_status_without_permissions() {
 		$draft_id = $this->factory->post->create( array(
 			'post_status' => 'draft',