The infamous "Reckoning Bomb." Reckoning was an ability which gave an extra attack on the next swing after getting hit with a critical attack. Like most sane and reasonable people: Blizzard assumed that players were not going to stand in one spot getting crit for hours just to go one-hit a raid boss. So, they didn't put any cap on the number of stacks the ability could have, and thus the number of extra attacks the player could get. But, the class which had this ability-the paladin-was also the most annoying to level. So anyone who leveled it to 60 (which took months) was exactly the sort of person who would intentionally get crit thousands of times just to one-hit a raid boss. All the thousands of Reckoning charges would be emptied out instantly in one hit, killing the boss on the spot. This was patched within hours of being used.
On the Horde side this manifested in the Shaman's "Windfury" ability, which gave each autoattack a chance to provide an extra strike, except that the ability could trigger off its own extra attacks. While not as bad as the Reckoning Bomb, a Windfury shaman could easily one-shot somebody if he got lucky. Both Reckoning Bomb and Windfury were highly typical of early World of Warcraft, when moves existed where depending on RNG you could find yourself instantly killed with nothing you could do about it.
On the PvP front rogues at one point enjoyed the possibility of "stunlocks" in Player Versus Player, which meant they could use their various stunning/disabling skills to make an enemy completely unable to defend themselves for an unlimited amount of time. If a rogue caught you alone, you were dead - end of story. The infamous 'World of Roguecraft' series of videos featured a player using stunlocks along with the Eviscerate move, which at the time did static damage no matter what the user's attack stats were, to kill players while naked, using the weakest dagger in the game. This was counteracted by so-called Diminishing Returns in PvP, which make such abilities less and less effective the more they are used against the same opponent in a certain timeframe, as well as special PvP equipment that allows players to break free of one such effect every few minutes. Players could similarly use Fear spells to permanently lock down players until the implementation of diminishing returns.
For a period of time in 2v2 arena, all the top teams were Warrior/Druid, caused by a coincidental occurrence of warriors and druids becoming kings of PvP damage and healing (respectively) at the same time. The Warrior had high armor, high damage, and great debuffs. The Druid had instant-cast heals, high speed in cat form to escape targeting, high armor in bear form if it couldn't, and also had great debuffs. The classes weren't game breakers on their own, but as a team in a 2v2 scenario and played by skilled players they were almost unkillable. Video exists from this period of Warrior/Druid teams fighting each other and the match going on for hours.
Patch 3.0 gave classes their level 80 abilities at level 70 before Wrath of the Lich King was released. This patch became known as "Wrath of the Retadin" because of the absurd (and unintended) buff this gave to paladins. It was so bad that other classes didn't even bother to try to fight them, leading to battlegrounds 3/4 full of Paladins. Although the developers intended for the game to balance out as the characters were leveled, the outrage and forum outcry was enough that Blizzard took the nerfbat to Paladins early, making them even weaker than they were before the buff (previously Retribution Paladins had always been considered to be jokes). They weren't fixed until the Secrets of Ulduar patch rebalanced the skills of every class.
Zul'Aman was also famous for creative ways to use certain skills to subvert major parts of the dungeon's challenges; pulling enemies using pets to get past walls, preventing them from summoning Goddamned Bats, certainly helped, but then there was the challenge of one boss being that it was a 5-man team, and you could (now fixed) literally make all but the "leader" despawn using a creative trick involving a frost trap and a naked blood elf.
Wrath of the Lich King
Initially mages had a talent which caused them to increase their damage if they absorbed from a damage shield like Mana Shield. Mages also at max level got a spell which lets them steal a buff from an enemy for up to 2 minutes. One of the NPCs in the first raid instance would occasionally give themselves a million point damage shield. Cue a mage who steals this spell and keeps stealing it again before it wears off to be pretty much invulnerable and powerful enough to solo a boss meant for 25 people by dragging the NPCs to the boss. This was quickly fixed by making the spell not stealable, and also making the talent have a limit to how much bonus damage you could get. At least one player showing off got banned for doing this exploit.
Early Wrath Starfall gave Moonkins the very useful (but unintended) ability to break enemy Rogues out of stealth in a huge area, along with a chance to stun. It didn't last long however, and the spell became very underwhelming without these traits.
Something similar happened with the Death Knight spell Blood Boil, which hits everything in a 10-yard radius around the Death Knight. When the class was first introduced, the ability would fail to cast if there were no targets in range. Players quickly realized this meant they could spam the button if they suspected a stealthed Rogue or Druid was nearby, and it would hit them and knock them out of stealth the second they came within range. Blizzard eventually changed this so that Blood Boil will cast (and consume Runes, making it non-spammable) regardless of whether it hits anything, but will only generate Runic Power if it does.
For a very short period in patch 3.3, Fire Mages had an unintended effect in one of their talents (Pyroblast can be cast instantly with two consecutive critical hits, at a cost of 0 mana) that caused their primary nuke spell (which normally has a long, 5-second time to cast) to be available as an instant-cast more often that intended, leading to the possibility of a situation where the Mage can repeated spam this high-damage ability for significant burst damage. As a result, a hotfix was quickly released to prevent damage over time critical hits from counting towards consecutive critical hits.
The Tol Barad PvP zone was originally grossly imbalanced in favor of the defending force. (This was the developers' intention, to make players value holding it instead of relying on them having it within a few battles.) The goal of the zone is to capture three fortifications, which form a triangle around a central point. The defenders spawn in the middle. Here's the problem: In order to cap the flags, the attackers need to outnumber the defenders. Fair enough, except that in order to win the attackers need to have all three forts capped at the same time. The attackers respawn right outside the closest fort they're trying to cap, whereas the defenders respawn in the middle of the map. This means that the defenders are equidistant from all flags, while the attackers are closer to the fort they're trying to capture and further away from those they aren't. This resulted in a merry-go-round with the attackers desperately trying to capture the forts in front of them while the defenders simply retook the bases they just left. Blizzard eventually fixed it, mostly by altering how fast the keeps convert - the more forts capped, the faster they covert, meaning once you already have 2 forts, the third caps quite fast.
During patch 4.3, a hotfix patch for the Dragon Soul raid had the unintentional effect of causing the Censure DOT from the Retribution Paladin spell Seal of Truth to start exponentially reapplying versions of itself, allowing Ret Paladins to start doing so much damage that they could solo raid bosses, and hitting other players in PVP with so much damage that it would disconnect them from the server. Fortunately, it only lasted for five hours before it was fixed.
Mists of Pandaria
At the start of Mists of Pandaria, Holy Shock, a spell for Holy Paladins was made this. It dealt incredible amounts of damage and in PvP, could easily take off 60-90% of a target's health, if not one-shotting them outright. Its damage output was cut by a full 60% later, but for a while it was a bloodbath.
Beast Mastery Hunters due to one, incredibly great skill. Stampede which summoned out 6 pets for the hunter and increased their damage by 75%. The math for this? 175x6x0.5 (how much the pet is doing x how many pets x % of the hunter's damage) is 525% damage. The Hunter could then pop Deterrence and become literally invulnerable while his pets tore his opponent apart. Has gone through a lot of tweaking to be balanced yet faithful to the concept.
Warlords of Draenor
As part of the (now removed) Legendary Ring quest, players teamed up with Khadgar and Chromie to defeat the spirit of the Bronze Dragon Kairozdormu. The three of you form the usual Damager, Healer, Tank trio, and if the player is DPS, Chromie takes on the healer role; it turns out she's terrible at it, but is a much better DPS. A decent DPS player could take the healer role, and with theirs and Chromie's combined DPS, burn down Kairozdormu before the lack of healing becomes a problem. Or you could mark him with the "N.U.K.U.L.A.R. Target Painter" and one shot him.
Greater Pyroblast, a Fire mage PvP talent. It sends a fireball that deals a flat 35% of a player's health, which would be somewhat balanced by the projectile's slow movement speed and its base cast time of 4.5 seconds were it not for the fact that it also had no cooldown and only cost 5% of the user's mana, so they could keep firing it off for as long as they're not interrupted. Shadowlands more or less nerfed it into the ground by slapping a 15-second cooldown on it, taking away its biggest strength.
Two DPS classes, the Fire mage and the Unholy death knight had self-healing abilties that (with good stats) could do insane amounts of HPS. Not only were the actual healing classes a bit tilted, but also these abilties could be used to cheese certain fights.
While it is normal for players to develop a most efficient strategy for dungeons, usually this has nothing to do with what classes are in the group. In Black Rook Hold however, groups with a death knight had a distinct advantage. See, there were these extremely powerful mobs which cast a hard-hitting spell and the thing is that they happened to be the undead type. This meant that death knights could control them using a class ability. This class ability, unchanged since Wrath of the Lich King, was intended mainly as flavor. Most of the undead in the game are so weak that there is little practical purpose for the ability, other than as a crowd-control ability. However, this mob did as much damage as a player mage and furthermore was immune to the boss mechanics (which is standard: to prevent players from using the boss to kill the other mobs). Basically, it broke the dungeon. Fortunately, the mob couldn't be dragged outside of the dungeon.
Battle for Azeroth
The Corruptions introduced in 8.3 were not properly balanced at launch and even after multiple nerfs were still insanely overpowered. It's entirely possible for some corruptions, such as Twilight Devastation, to do more damage than all of a player's other skills combined. This was especially bad in arenas where a melee player could destroy an enemy team with a single lucky proc.
Starting in 8.2, the new world quest pet battles were all against single powerful pets rather than teams. It was quickly determined that nearly every pet could be defeated using a pet team such as Unborn Val'kyr, Ikky, and Macabre Marionette. The combo of a single hard-hitting delayed spell (Curse of Doom), Black Claw, and Flock (Ikky) is devastating against a single enemy pet. It was so bad that the devs put in a nerf on the combo in 8.3, though it still remained effective.
Torghast's Anima Powers provide a fair share of overpowered situations:
Druids can trivialize Torghast by getting Curious Bramblepatch at least once, which makes Entangling Roots deal damage per second to the affected target. This would normally not make it much more different from any damage over time effect, but what breaks it is that the damage caused by Curious Bramblepatch does not generate aggro. You can outright stand afar and kill even Elites and Rares with Entangling Roots alone without them even considering fighting you, and this is helped further by the fact Curious Bramblepatch is a Common Anima Power, and that stacks increase the damage it deals. The only place where it fails is against the Layer Boss, upon which Entangling Roots suffers from diminishing returns, but if you can get at least one of this Anima Power early on, you can safely get to the boss with your death counter intact.
Mages have Runecloth Wrappings, which increases the power of Fireball, Frostbolt, and Arcane Blast by 2000% if cast while invisible. For Frost and Fire Mages, the Anima Power is good, but nothing overwhelming, as you can only get the benefit once. Arcane Mages, on the other hand, get a full three seconds of abusing Runecloth Wrappings thanks to Greater Invisibility granting a damage taken reduction buff for three seconds; with a combination of Presence of Mind, Rune of Power, Arcane Power, and 4 Arcane Charges, an Arcane Mage with Runecloth Wrappings can annihilate even Layer bosses in an instant, moreso if they have Seeker's Scroll with a sufficiently large amount of stacks.
Another unassumingly powerful Anima Power for a specific Mage spec is Highly-Polished Handmirror. This makes Mirror Images stop staying in place and cast only Frostbolt and instead move around and use a set of abilities that depend on your active specialization. Arcane and Frost Mages can find some utility in this Power, but the fact Mirror Images no longer draw aggro from you makes you lose significant defensive utility from what is often used as a defensive spell. Fire Mages, on the other hand, will quickly realize that the Mirror Images gain the ability to cast Greater Pyroblast of all things, turning Mirror Image from a defensive to your main attacking spell, and Anima Powers that increase health to also increase your DPSnote Against NPCs, Greater Pyroblast deals damage equal to 35% of your own health; it also helps that the Mirror Images might cast Dragon's Breath which works as another Interrupt effect. Even if Mirror Image is in cooldown, Highly-Polished Handmirror also affects the Mirror Images generated when you Blink or Shimmer when you have the Clouded Diamond Anima Power.
The ultimate overpowered Anima Power is getting Crumbling Aegis from a Plundered or Requisitoned Anima Cell in a boss Layer. 1.5 minutes of complete immunity is usually more than enough to defeat a boss, regardless of your other Anima Powers.
Druids who pick the Night Fae Covenant get the Class Ability Convoke the Spirits, which makes them cast 16 random spells in 4 seconds of channeling. While the spell is, in itself, very reliant on RNG and can be easily interrupted, when neither thing is a problem, it becomes ridiculously powerful. Balance Druids in particular were incredibly difficult to deal with without a timely interrupt, as a series of Starsurges or Full Moons could easily kill a full-health player before they could react; this is without mentioning the chance of casting Renewal or Restoration for a heavy heal-over-time effect. Blizzard eventually prevented Convoke the Spirits from casting Full Moon when fighting against enemy players... but only for the Balance specialization, which caused two problems: first, that it doesn't fix the problem of getting hit by multiple Starsurges in a row, and second, that other specializations can still get Full Moons if they have the Balance Affinity Talent. This took until Patch 9.0.5 to be fixed so that Convoke the Spirits cannot use Full Moon (or Feral Frenzy) on PvP.
The Jademist Dancers on the Timeless Isle have an extremely slim chance of dropping themselves as a pet. If you luck out and get one or buy one on the Auction House, it has respectable Power even without a P/S (+45% Power and Speed) or B/B (+25% Health, Power and Speed) breed and all of its possible breeds give it above average Speed. When it comes to its moveset, it starts off with Steam Vent, which does a massive amount of Aquatic damage that gets buffed even more by the Cleansing Rain weather effect caused by when it learns Acid Rain at 4, and at level 2 it learns Jadeskin (compared to most other pets who don't learn damage reduction abilities until later), which not only reduces damages taken by direct attacks but can also completely nullify Damage Over Time effects as well, so you can laugh as the Dancer easily shrugs off poison from snakes, spiders and scorpids.
The Unborn Val'kyr. Its attack Haunt instantly kills it and deals damage over time to the opponent for 4 rounds. Here's the kicker: it brings the Val'kyr back to life after the timed effect ends (or if at least 2 turns have passed on the dot), even if she was killed before using it and was on her invincibility grace round. It is an extremely difficult pet to fight as a result, especially since it forces the player to use Critter-type moves, the most underused type, to kill it quickly.
Grommloc, the BlizzCon 2014 murloc pet that's dressed as Grom Hellscream and fights with a miniature Gorehowl. His first ability Vicious Slice does so much damage even at early levels that it might also qualify as a Disc-One Nuke, while his second is Clobber, which is a stun, and his third is Giant's Blood, which is both a heal and a damage buff, the former effect overlapping with the Humanoid type's ability to regenerate health when it deals damage and giving him serious longevity, and the latter making Vicious Slice hurt even more. If you need a Beast attack he later learns Smash at 10, if you need a harder-hitting Humanoid move he learns Mighty Charge at 15, or you can keep using Clobber for when he learns Takedown at 20, which deals double damage against stunned opponents. The fact that he has lower than average health won't matter when you're destroying most pets without a great Undead move.
Speaking of Undead, the release of Heroes of the Storm in 2015 coincided with a promotional: Earn account level 20 in HotS, gain the battle pet Graves, an undead Bone Golem with a slew of similar abilities. First is Skull Toss with even more base damage than Vicious Slice. Its second was BONESTORM, a self-damaging move that dealt a small amount of damage to the entire enemy team, which is generally rare as an effect, but is topped by Grave Destruction which is nearly identical except dealing more damage, doesn't recoil, destroys objects, only shares those properties with 7 other moves in the game, is one of the highest damaging of those moves, and is only obtainable by Graves. His third is the aforementioned clobber, though he doesn't gain any synergy like Grommloc, and both his 4th and 6th are heals, the first being Consume, which isn't as great as other life leech abilities but still holds its own, and the second being Consume Corpse, which is a 50% heal usable once for each dead pet. Importantly, that last one works on a Haunting Valk'yr. Combined with being H/P this turns Graves into one of the most insanely unkillable tanks who can pretty reliably take down pets that aren't even in play. The only saving grace is the promotional hasn't ended.