Malicious code on website – need FTP access

Hi, I have malicious code on my website. I booked Sucuri https://sucuri.net/ to delete the malcode but they can`t access the page. They need an ftp access. Is there any possibility to create an FTP access for an WordPress.org site? Or can the cleaning of the malware be done by WordPress itself??

I also tried to check the installed plugins to see if there is any issue right now. Unfortunately, while logging into wp-admin it`s asking me to update the database. Due to the malware I did not want to do it. Do you think this is unrisky?

Thank you so much for a fast feedback!
Patrick