The infamous "Reckoning Bomb", which gave an extra attack on the next swing after getting hit with a critical attack. Problem is Blizzard forgot to put a cap on the number of charges you could accumulate. That is to say, a paladin could spend a few hours doing nothing but standing in one spot getting crit while someone healed him, then go and hit a raid boss. All the thousands of Reckoning charges would be emptied out instantly in one hit, killing the boss on the spot. Needless to say, the exploit was quickly patched.
On the Horde side this manifested in the Shaman's "Windfury" ability, which gave each autoattack a chance to provide an extra strike. Again, Blizzard failed to consider that the ability could trigger off its own extra attack. Both Reckoning Bomb and Windfury were highly typical of early World of Warcraft, when moves existed where depending on RNG you could find yourself instantly killed with nothing you could do about it.
On the PvP front rogues at one point enjoyed the possibility of "stunlocks" in Player Versus Player, which meant they could use their various stunning/disabling skills to make an enemy completely unable to defend themselves for an unlimited amount of time. Once a rogue caught you, you were dead - end of story. The infamous 'World of Roguecraft' series of videos featured a player using stun locks along with the Eviscerate move, which at the time did static damage no matter what the user's attack stats were, to kill players while naked, using the weakest dagger in the game. This was counteracted by so-called Diminishing Returns in PvP, which make such abilities less and less effective the more they are used against the same opponent in a certain timeframe, as well as special PvP equipment that allows players to break free of one such effect every few minutes.
For a period of time in 2v2 arena, all the top teams were Warrior/Druid, caused by a coincidental occurrence of warriors and druids becoming kings of PvP damage and healing (respectively) at the same time. The Warrior had high armor, high damage, and great debuffs. The Druid had instant-cast heals, high speed in cat form to escape targeting, high armor in bear form if it couldn't, and also had great debuffs. The classes weren't game breakers on their own, but as a team in a 2v2 scenario and played by skilled players they were almost unkillable. Video exists from this period of Warrior/Druid teams fighting each other and the match going on for hours.
In classic vanilla, Warlocks were often considered underpowered and quite weak in PvP, and were often only brought along for specific PvE encounters. Come expansion time, massive buffs skyrocketed warlocks to top damage dealers in PvE, and they became close to invincible in 1v1 PvP except against other warlocks. They were eventually balanced.
Patch 3.0 gave classes their level 80 abilities at level 70 before the 'Wrath' expansion was released. This patch became known as "Wrath of the Retadin" because of the absurd (and unintended) buff this gave to paladins. It was so bad that other classes didn't even bother to try to fight them, leading to battlegrounds 3/4 full of Paladins. Although the developers intended for the game to balance out as the characters were leveled, the outrage and forum outcry was enough that Blizzard took the nerfbat to Paladins early, making them even weaker than they were before the buff (previously Retribution Paladins had always been considered to be jokes). They weren't fixed until the Secrets of Ulduar patch rebalanced the skills of every class.
Zul'Aman was also famous for creative ways to use certain skills to subvert major parts of the dungeon's challenges; pulling enemies using pets to get past walls, preventing them from summoning Goddamned Bats, certainly helped, but then there was the challenge of one boss being that it was a 5-man team, and you could (now fixed) literally make all but the "leader" despawn using a creative trick involving a frost trap and a naked blood elf.
Wrath of the Lich King
Early Wrath Starfall gave Moonkins the very useful (but unintended) ability to break enemy Rogues out of stealth in a huge area, along with a chance to stun. It didn't last long however, and the spell became very underwhelming without these traits.
Something similar happened with the Death Knight spell Blood Boil, which hits everything in a 10-yard radius around the Death Knight. When the class was first introduced, the ability would fail to cast if there were no targets in range. Players quickly realized this meant they could spam the button if they suspected a stealthed Rogue or Druid was nearby, and it would hit them and knock them out of stealth the second they came within range. Blizzard eventually changed this so that Blood Boil will cast (and consume Runes, making it non-spammable) regardless of whether it hits anything, but will only generate Runic Power if it does.
For a very short period in patch 3.3, Fire Mages had an unintended effect in one of their talents (Pyroblast can be cast instantly with two consecutive critical hits, at a cost of 0 mana) that caused their primary nuke spell (which normally has a long, 5-second time to cast) to be available as an instant-cast more often that intended, leading to the possibility of a situation where the Mage can repeated spam this high-damage ability for significant burst damage. As a result, a hotfix was quickly released to prevent damage-over-time-critical-hits from counting towards consecutive critical hits.
The Tol Barad PvP zone was originally grossly imbalanced in favor of the defending force. (This was the developers' intention, to make players value holding it instead of relying on them having it within a few battles.) The goal of the zone is to capture three fortifications, which form a triangle around a central point. The defenders spawn in the middle. Here's the problem: In order to cap the flags, the attackers need to outnumber the defenders. Fair enough, except that in order to win the attackers need to have all three forts capped at the same time. The attackers respawn right outside the closest fort they're trying to cap, whereas the defenders respawn in the middle of the map. This means that the defenders are equidistant from all flags, while the attackers are closer to the fort they're trying to capture and further away from those they aren't. This resulted in a merry-go-round with the attackers desperately trying to capture the forts in front of them while the defenders simply retook the bases they just left. Blizzard eventually fixed it, mostly by altering how fast the keeps convert - the more forts capped, the faster they covert, meaning once you already have 2 forts, the third caps incredibly fast.
Mists of Pandaria
At the start of Mists of Pandaria, Holy Shock, a spell for Holy Paladins was made this. It dealt incredible amounts of damage and in PvP, could easily take off 60-90% of a target's health, if not one-shotting them outright. Its damage output was cut by a full 60% later, but for a while it was a bloodbath.
Beast Mastery Hunters due to one, incredibly broken skill. Stampede which summoned out 6 pets for the hunter and increased their damage by 75%. The math for this? 175x6x0.5 (how much the pet is doing x how many pets x % of the hunter's damage) is 525% damage. The Hunter could then pop Deterrence and become literally invulnerable while his pets tore his opponent apart. Has gone through a lot of tweaking to be balanced yet faithful to the concept.
The Jademist Dancers on the Timeless Isle have an extremely slim chance of dropping themselves as a pet. If you luck out and get one or buy one on the Auction House, it has respectable Power even without a P/S (+45% Power and Speed) or B/B (+25% Health, Power and Speed) breed and all of its possible breeds give it above average Speed. When it comes to its moveset, it starts off with Steam Vent, which does a massive amount of Aquatic damage that gets buffed even more by the Cleansing Rain weather effect caused by when it learns Acid Rain at 4, and at level 2 it learns Jadeskin (compared to most other pets who don't learn damage reduction abilities until later), which not only reduces damages taken by direct attacks but can also completely nullify Damage Over Time effects as well, so you can laugh as the Dancer easily shrugs off poison from snakes and scorpids.