diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php
index 77aaf718b1..56c36067bc 100644
--- a/src/wp-includes/functions.php
+++ b/src/wp-includes/functions.php
@@ -4821,6 +4821,9 @@ function wp_parse_list( $list ) {
 		return preg_split( '/[\s,]+/', $list, -1, PREG_SPLIT_NO_EMPTY );
 	}
 
+	// Validate all entries of the list are scalar.
+	$list = array_filter( $list, 'is_scalar' );
+
 	return $list;
 }
 
diff --git a/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php b/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php
index 2b543be296..deb83c2f03 100644
--- a/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php
+++ b/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php
@@ -2895,7 +2895,6 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
 			'items'             => array(
 				'type' => 'string',
 			),
-			'sanitize_callback' => 'wp_parse_slug_list',
 		);
 
 		$query_params['status'] = array(