The site contents don't necessarily matter. You're at a coffee shop or library using their WiFi. Your computer sends a plaintext HTTP message. The attacker jus

The site contents don't necessarily matter. You're at a coffee shop or library using their WiFi. Your computer sends a plaintext HTTP message. The attacker just needs to be able to see that message and get a response back to you before the real site does, and the real site is a lot further away than the guy sitting at the table next to you (or the hacked router, if he doesn't want to be there in person). Then they can feed your browser whatever they want. A login form to phish you, perhaps? They can even start replying, then go off and fetch from the actual site before finishing the response, if it helps to incorporate the real data.