The greatest risk is if the site logs login attempts based on the username that a user enters, rather than the account. Your password will then be displayed in cleartext in the logs, which may be leaked at some future time.
In most cases, nothing risky will happen. The site already has access to your cleartext password while you're logging on, whether they store it securely or not, so sending your password to that site in a different form field wouldn't have consequences, unless other users can see what you've entered into that field.
The normal best practices apply, of course: Never reuse your password across different sites. The site owner might be malicious, and even large, trustworthy, highly audited multinational companies will leak customer data at alarming rates. Your information has already been leaked.
This way, if you don't reuse any passwords, and use a password manager to generate truly random, unique passwords for each site, when you suspect that a password might leak, such as being logged when it shouldn't after you put it into the wrong form field, then you can update the password once on that site only, and your risks will be mitigated.