I work for a small catholic non-profit. We paid this company to build us a site and they used wordpress to build it.  The site gets literally traffic only from me (sometimes a donor), and this company was charging us like 200 bucks a month for google analytics, so we canceled it. 

Now the site needs to be upgraded to the latest version of wordpress, but I am unable to do it.  The reason for upgrade is we have a cart for donations that occasionally we get some money from, and if we are out of compliance we get charged 20 bucks a month till we are updated. 

Do we have to go through this company from now till forever to update our site since they built it? I am an admin on the wordpress backend, but obviously I can't update it because I'm not the owner nor do I have access to the files; I'm assuming they are on their server. 

Also, don't want to pay them 200 dollars a month so they can press the update button that I see on the admin page, but of course doesn't work for me.