Within a man in the middle attack the attacker is in the path between client and server and can thus sniff and manipulate the traffic. This is for example possible if the attacker is a government agency which has sufficient control over the traffic leaving and entering the country, as it was true with Iran in this specific case.
In the context of SSL this is used by terminating the connection from the client at the attackers system and then creating a new SSL connection between the attacker system and the server. I.e. the attacker decrypts the traffic from the client, analyzes and manipulates the unencrypted traffic and then encrypts it again when sending it to the server. And the same for traffic from server to client.
In order to terminate the SSL traffic the attacker needs to have a certificate which will be accepted by the victim (the client). Usually the attacker does not have such a certificate which was issued by a publicly trusted CA which causes the client to display a warning that the certificate is not trusted. But in this specific case the attacker could compromise a public CA and make it issue the necessary publicly trusted certificate. With no certificate or CA pinning the browser will simply trust this new certificate since it was issued by a CA trusted in the browser.
