MITM is the main issue, anything that is capable of monitoring your transmissions can capture/replay data - and of course dynamically change data - with impunity.
This is really bad practice for any site and you should let them know immediately.
Ideally, you should not use the site. If you feel you have to, make absolutely certain you do not give any data that might be used for identity theft, phishing or similar attacks.
I always find it really remarkable that, in this age of cyber attacks, that some site owners and some users still seem to have absolutely know clue that this is an issue.
If, as implied, this is just a forum site, I would still ensure that I didn't use my "normal" email address and certainly I wouldn't reuse a password. Also be aware that it is possible (though I admit not that likely) that someone could easily impersonate you if they wanted to.
There is no excuse for this - even cheap hosting sites will generally offer a cheap shared SSL/TLS option which is enough to stop all but the most determined and resourceful attackers.
For Update 2: Immediately remove any personally identifiable data and ensure you have no financial data registered. If you did register financial details, report the site to your bank/credit-card company immediately - it is likely that the site would loose their ability to sell.
If you reused an email address, try to change it as quickly as possible. Many mail services allow email@example.com or whatever, e.g. you can add a +something after your name though not all registration functions will accept a plus symbol (though they should as it is part of the RFC). If you can't do that, try creating a free mail account (e.g. Gmail, Outlook.com, etc) and use that instead.
If you reused a password, change the reused password on all other sites straight away & turn on two-factor-authentication wherever possible to help prevent identity theft.
If you shared your physical location or other personal details, you should just monitor the situation - after removing the details - it is actually very unlikely that anyone will have been able to do anything so don't panic, just be sensible. Also, even if you only share your City or county take note if you have an unusual name for your locality. Maybe think again about sharing in that case.
Update 3: Having SSL on the login input page, the login transactions and any user profile pages is the absolute minimum for a site that has a login. You must also have it on any secure transactions of course and that includes any session interactions. It is all too easy to make a configuration mistake. Also, it is easy to end up with other pages over time that should be protected. There are also some standards that require all interactions to be over TLS. So you can see that it is by far the best practice to simply make everything TLS secured and have done with it.