diff --git src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php
index 9d7f85a..36b0e48 100644
--- src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php
+++ src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php
@@ -1906,8 +1906,8 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
 			'default'           => 'publish',
 			'description'       => __( 'Limit result set to posts assigned a specific status; can be comma-delimited list of status types.' ),
 			'enum'              => array_merge( array_keys( get_post_stati() ), array( 'any' ) ),
-			'sanitize_callback' => 'sanitize_key',
-			'type'              => 'string',
+			'sanitize_callback' => 'wp_parse_slug_list',
+			'type'              => 'array',
 			'validate_callback' => array( $this, 'validate_user_can_query_private_statuses' ),
 		);
 		$params['filter'] = array(
@@ -1946,7 +1946,7 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
 	 * @return WP_Error|boolean
 	 */
 	public function validate_user_can_query_private_statuses( $value, $request, $parameter ) {
-		if ( 'publish' === $value ) {
+		if ( 'publish' === $value || is_array( $value ) && count( 1 === $value ) && in_array( 'publish', $value, true ) ) {
 			return true;
 		}
 		$post_type_obj = get_post_type_object( $this->post_type );